Aqua Security step configuration

Scan container images with Aqua Security.

You can scan your container images and ingest scan results from Aqua Security Enterprise.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Aqua Security step settings

The recommended workflow is to add an Aqua Security step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

For the Aqua Security step, you have two configuration options:

• Default: Connects to your Aqua Security instance using an Access Token for authentication.

• Self-Hosted: Connects to your on-premises Aqua Security instance using a Username and Password for authentication.

Target

Type

Target and Variant Detection

Name

Variant

Container image

Type

Domain (extraction)

Name

Tag/Digest

Region

Authentication

Domain

Access ID

Enter the username for your on-premises Aqua Security instance. This field is visible only when you select the Self-Hosted scan configuration.

Access Token

• For the Default scan configuration, enter your Aqua Security access token.

• For the Self-Hosted scan configuration, enter the password associated with your Aqua Security username.

Always store sensitive credentials securely by creating a Harness text secret. Reference the secret in your configuration using the format <+secrets.getValue("my-access-token")>. For detailed steps, see Add and Reference Text Secrets.

Ingestion

Ingestion File

Log Level

Additional CLI flags

Fail on Severity

Additional Configuration

Advanced settings

Proxy settings

View AquaSec Assurance Policy violations

AquaSec Assurance Policy violations will appear in scan results as Info severity issues, with the issue type set to EXTERNAL_POLICY. Additionally, you can apply OPA policies in Harness STO to enforce or manage these failures. Additionally, you can apply an OPA policy to fail the pipeline based on the security assurance policy violations. This can be achieved using the Security Tests - External Policy Failures policy from the security tests policy samples.

Configure External Policy Failures

You can configure Harness STO to treat external policy failures as vulnerabilities. To do this, navigate to Account Settings, go to the Default Settings page, select Security Test Orchestration, and click the External Policy Failures setting.

Enable the external policy failures setting to map them to a selected severity level — Critical, High, Medium, or Low to treat them as vulnerabilities instead of Info level issues. This setting takes effect from the next pipeline execution.

This feature is behind the Feature flag STO_EXTERNAL_POLICY_FAILURES_AS_VULNS. Contact Harness Support to enable this flag.