> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aws-security-hub-scanner-reference.md).

# AWS Security Hub step configuration

You can scan your configurations and ingest the scan results from [AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html).

### Important notes for running AWS Security Hub scans in STO <a href="#important-notes-for-running-aws-security-hub-scans-in-sto" id="important-notes-for-running-aws-security-hub-scans-in-sto"></a>

* This integration supports session-based authentication with AWS. You can pass the token as a key-value pair in the [Settings](#settings) field.
* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### AWS Security Hub step configuration <a href="#aws-security-hub-step-configuration" id="aws-security-hub-step-configuration"></a>

The default workflow is to add an AWS Security Hub step to a Build or Security stage and configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Name**

**Variant**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Authentication <a href="#authentication" id="authentication"></a>

You should create [Harness text secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) with your encrypted access ID and token and access them using the format `<+secrets.getValue("my-secret")>`.

**Access ID**

The access ID for your AWS account.

**Access Token**

The access token for your AWS account.

**Access Region**

Your AWS region.

#### Log Level <a href="#log-level" id="log-level"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

To enable session-based authentication with AWS, for example, you can pass AWS session token using the key `CONTAINER_SESSION_TOKEN` with a [Harness text secret](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) of your token.

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>