Safeguard Docs
Compliance ConnectorsSetup by categoryVulnerability Scanning

AWS Inspector

Connect AWS Inspector to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect AWS Inspector to collect vulnerability scanning evidence automatically.

CategoryVulnerability Scanning
Connect withAPI token
What a connection producesAutomated evidence collection

Connect with an API token

  1. In AWS Inspector:

    1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
    2. In the navigation pane, choose Users, then choose the user name of the IAM user Safeguard will use (create a dedicated user first if needed).
    3. On the Security credentials tab, in the Access keys section, choose Create access key.
    4. On the Access key best practices & alternatives page, choose Other, then choose Next.
    5. (Optional) On the Set description tag page, add a description tag, then select Create access key.
    6. On the Retrieve access key page, choose Show to reveal the secret access key, or choose Download .csv file. This is your only time to view or download it.
    7. In the IAM console, choose Users and choose the same user.
    8. On the Permissions tab, select Add permissions, then choose Attach policies directly.
    9. Select the AWS managed policy AmazonInspector2ReadOnlyAccess (read-only access to Amazon Inspector), choose Next, then choose Add permissions.

    Where to find the other values:

    • AWS Access Key ID: Shown on the Retrieve access key page and in the downloaded .csv file; also listed in the user's Security credentials tab under Access keys.

    AWS Inspector shows the secret only once, so copy it before you leave the page.

    If Create access key is deactivated, delete one of the existing keys first. If the user has a permissions boundary, you cannot add permissions beyond what it allows. AmazonInspector2ReadOnlyAccess also allows viewing Inspector coverage details for an AWS Organizations organization. The Retrieve access key page is the only time the secret can be viewed.

    Source: docs.aws.amazon.com, docs.aws.amazon.com, docs.aws.amazon.com, checked 2026-10-07.

  2. On Compliance › Connectors, open AWS Inspector, click Connect, choose API token and fill in:

    FieldWhat to enter
    AWS Access Key IDRequired. Stored encrypted and never shown again.
    AWS Secret Access KeyRequired. Stored encrypted and never shown again.
    RegionOptional.
    Session token (optional)Stored encrypted and never shown again.

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read AWS Inspector and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsA1.1, A1.2, A1.3, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC7.1, CC7.2, CC7.3, CC7.4, CC8.1148
ISO/IEC 27001Automated testsA.5.12, A.5.16, A.5.17, A.5.18, A.5.24, A.5.25, A.8.2, A.8.3, A.8.5, A.8.6, A.8.8, A.8.9, A.8.11, A.8.12, A.8.13, A.8.14, A.8.15, A.8.16, A.8.20, A.8.24, A.8.32148
HIPAA Security RuleAutomated tests164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1)81
PCI DSSAutomated tests1.3.1, 3.5.1, 3.7.4, 4.2.1, 6.3.1, 6.3.3, 6.4.2, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.3.6, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.5.1, 11.3.1, 11.5.1, 11.5.281
NIST CSF 2.0Automated testsDE.AE-02, DE.CM-01, DE.CM-09, ID.AM-07, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.IR-03, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02, RS.MA-01148
CIS AWS Foundations BenchmarkAutomated tests1.1, 1.2, 1.6, 1.7, 1.11, 1.13, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 2.1.1, 2.1.2, 2.1.3, 2.3.2, 2.4.1, 3.4, 3.8, 3.9, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 5.1, 5.4, 5.641

For a CIS benchmark, the numbers are its recommendations.

These tests are switched on per workspace by the Safeguard team.

Amazon CloudWatch, Amazon S3, Amazon Web Services, AWS CodeCommit, AWS GovCloud, AWS Security Hub connect to the same provider as AWS Inspector, and these tests run for a connection made through any of them.

Arnica

Connect Arnica to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Bright Security

Connect Bright Security to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with an API tokenFrameworksRelated