{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45857,"path":"security-management/vulnerability-response/aws-sem-integrations.md","title":"AWS Integration for Security Exposure Management integrations","bundle":null,"doc_type":null,"release":"australia","body":"\n# AWS Integration for Security Exposure Management integrations\n\nIntegrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.\n\n## Required roles\n\nUsers who configure and use the integration must be assigned the appropriate ServiceNow roles.\n\n-   **__sn\\_vul\\_aws.configure\\_integration__**\n\n    Allows you to configure authentication credentials for the AWS plugin.\n\n-   **__sn\\_vul\\_aws.read\\_integration__**\n\n    Provides read access to AWS integrations and AWS tables.\n\n\n## Dependencies\n\nAWS Integration for Security Exposure Management requires the following ServiceNow® applications:\n\n-   **Vulnerability Response** \\(required\\) — Core application for vulnerability management.\n-   **Container Vulnerability Response** \\(optional\\) — Required for the AWS Inspector Container and AWS Security Hub Container integrations.\n-   **Configuration Compliance** \\(optional\\) — Required for the AWS Security Hub Test Results integration.\n\n## AWS Inspector Integrations\n\n<table id=\"table_kxb_jw4_53c\"><thead><tr><th>\n\nIntegration\n\n</th><th>\n\nDescription\n\n</th><th>\n\nRun sequence and frequency\n\n</th></tr></thead><tbody><tr><td>\n\nAWS Inspector Host Vulnerability Integration\n\n</td><td>\n\n-   Retrieves all host vulnerability findings from AWS Inspector for EC2 Instances and Lambda Functions.\n-   Uses API: POST /findings/list.\n-   Supports delta synchronization using 'updatedAt' filter\n-   Uses 'nextToken' and 'maxResults' for pagination.\n-   Creates vulnerable items \\(VIT\\)s, discovered items, and Detections.\n\n</td><td>\n\nFirst, Daily.\n\n</td></tr><tr><td>\n\nAWS Inspector Container Vulnerability Integration\n\n</td><td>\n\n-   Retrieves all container vulnerability findings from AWS Inspector for ECR Container Images.\n-   Uses API: POST /findings/list.\n-   Supports delta synchronization using 'updatedAt' filter\n-   Uses 'nextToken' and 'maxResults' for pagination.\n-   Creates container vulnerable items \\(CVIT\\)s, discovered container images, and Findings.\n\n</td><td>\n\nSecond, Daily.\n\n</td></tr></tbody>\n</table>## AWS Security Hub Integrations\n\n<table id=\"table_rvc_y54_53c\"><thead><tr><th>\n\nIntegration\n\n</th><th>\n\nDescription\n\n</th><th>\n\nRun sequence and frequency\n\n</th></tr></thead><tbody><tr><td>\n\nAWS Security Hub Host Vulnerability Integration\n\n</td><td>\n\n-   Retrieves host vulnerability findings \\(EC2 Instances, Lambda Functions\\) from AWS Security Hub.\n-   Uses API: POST /findingsv2.\n-   Supports delta synchronization using 'finding\\_info.modified\\_time\\_dt'.\n-   Uses 'maxResults' and 'nextToken' for pagination.\n-   Creates vulnerable items \\(VIT\\)s, discovered items, and detections.\n\n</td><td>\n\nFirst, Daily.\n\n</td></tr><tr><td>\n\nAWS Security Hub Container Vulnerability Integration\n\n</td><td>\n\n-   Retrieves container vulnerability findings \\(ECR Container Images\\) from AWS Security Hub.\n-   Uses API: POST /findingsv2.\n-   Supports delta synchronization using 'finding\\_info.modified\\_time\\_dt'\n-   Creates container vulnerable items \\(CVIT\\)s, discovered container images, and Findings.\n\n</td><td>\n\nSecond, Daily.\n\n</td></tr><tr><td>\n\nAWS Security Hub Test Results Integration\n\n</td><td>\n\n-   Retrieves misconfigurations of various assets types from AWS Security Hub.\n-   Uses API: POST /findingsv2.\n-   Supports delta synchronization using 'finding\\_info.modified\\_time\\_dt'\n-   Creates tests and test results in Configuration Compliance.\n\n</td><td>\n\nThird, Daily\n\n</td></tr></tbody>\n</table>## AWS Inspector REST messages\n\n|Name|Endpoint|HTTP method|Description|\n|----|--------|-----------|-----------|\n|List Findings|`https://inspector2.${region}.amazonaws.com/findings/list`|POST|Retrieves findings from AWS Inspector. Uses `nextToken` and `maxResults` for pagination.|\n|STS AssumeRole|`https://sts.${region}.amazonaws.com/`|POST|Retrieves temporary security credentials via AWS STS AssumeRole.|\n\n## AWS Security Hub REST messages\n\n|Name|Endpoint|HTTP method|Description|\n|----|--------|-----------|-----------|\n|Get Findings|`https://securityhub.${region}.amazonaws.com/findingsv2`|POST|Retrieves findings from AWS Security Hub. Uses `NextToken` \\(PascalCase\\) for pagination.|\n|STS AssumeRole|`https://sts.${region}.amazonaws.com/`|POST|Shared with Inspector. Retrieves temporary security credentials.|\n\n**Note:**\n\nThe nextToken field uses PascalCase \\(NextToken\\) in Security Hub responses, unlike Inspector which uses camelCase \\(nextToken\\). The integration handles this difference automatically.\n\n"}}