Aqua Security

Record your Aqua Security connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Aqua Security:

   1. Sign in to the Aqua cloud console and open the API Keys page (https://cloud.aquasec.com/apikeys).
   2. Click Generate Key.
   3. Copy both the API Key and the Secret from the window that opens. Aqua warns: "Be sure to save the following secret; once you close this window it will no longer be accessible."
   4. Select the new key to open Edit API Key, enter a Description, and optionally restrict IP Addresses (comma-separated; empty means no IP restriction).
   5. Optionally choose an Aqua Group to limit the key to that group's resources. An empty group makes the key an account admin with access to all groups.
   6. In Edit API Key, leave Enable global admin permission unchecked and use Granular Permissions to give the key access only to the read APIs it needs, then click Save. By default, API keys have admin access to the account.

   Aqua Security shows the secret only once, so copy it before you leave the page.

   Aqua Security's public documentation does not cover every step.

   Steps come from the publicly served API Keys page of Aqua's cloud console (the CSPM/CloudSploit-era console). Aqua's platform documentation (docs.aquasec.com) redirects to sign-in, so the menu path to this page inside the newer Aqua Platform UI, the names of the individual granular permissions, any read-only or auditor permission set, and the regional API base URLs were not readable. Customers on the Aqua Platform (Workload Protection) should follow the signed-in API key guide there; it may differ from this console.

   Source: cloud.aquasec.com, checked 2026-10-07.

2. On Compliance › Connectors, open Aqua Security, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Aqua Security publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks