AWS Security Hub step configuration

Scan configurations with AWS Image scanner.

You can scan your configurations and ingest the scan results from AWS Security Hub.

Important notes for running AWS Security Hub scans in STO

• This integration supports session-based authentication with AWS. You can pass the token as a key-value pair in the Settings field.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

AWS Security Hub step configuration

The default workflow is to add an AWS Security Hub step to a Build or Security stage and configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Name

Variant

Ingestion File

Authentication

You should create Harness text secrets with your encrypted access ID and token and access them using the format <+secrets.getValue("my-secret")>.

Access ID

The access ID for your AWS account.

Access Token

The access token for your AWS account.

Access Region

Your AWS region.

Log Level

Fail on Severity

Settings

To enable session-based authentication with AWS, for example, you can pass AWS session token using the key CONTAINER_SESSION_TOKEN with a Harness text secret of your token.

Proxy settings