You can connect Aqua to multiple organizations of the same provider.

From the Integrations page, you can also integrate with CI/CD build platforms to detect any security issues in the configurations of the platform. For more information, refer to Integration with Build Platforms.

curl https://connect.codesec.aquasec.com/
curl https://scan.codesec.aquasec.com/

Source Code Management

To integrate your code repository in the source code management tool using this method:

1. On the top right side of the Integrations screen, click Connect and select Source Code Management. The Source Code Management selection page will appear.
2. Select the required source code management tool. You can click Show More Options to see more tools. The Authentication section appears.

      3. In the Authentication section, complete the authentication to the source code management tool as instructed on the UI. This is required to grant Aqua the read/write access to the source code management tool for scanning your code repositories. The authentication process and details required for each source code management tool are different, as explained below.

Authentication section of the Azure integration is shown below for your reference:

       4. In the Repositories section, select the required code repositories that you want Aqua to scan and detect security findings.

       5. Click Start Scanning. The repositories will be added, and security findings will be displayed on the Code Repositories screen.

You can add any number of repositories to Aqua from an "Organization" in the source code management tool.

Once the selected code repositories are added and scanned, you can see these repositories and their security findings on the Code Repositories screen. You can also add more repositories of the connected source code management tool in the Code Repositories screen later. For more information, refer to Code Repositories List View.

By default, code repositories which have activities in the last six months are automatically selected for scanning, while integrating with its source code management tool for the first time. If required, Admins can check these code repositories and remove their selection. 

Example: Source Code Management connection with a code repository in GitHub

Watch the video below to see an example on how to connect a code repository in GitHub.

CI Integrations

You can integrate a new code repository manually by adding a code block displayed in the UI to your project in the CI build system. Different code blocks are displayed in the UI, depending on where you want to apply them: either Pull Request or Push. Select one of the following options. These options are visible when you select any repository hosting platform below except Jenkins and CircleCI.

• Pull Request: to scan the specific code changes in a pull request. When a new pull request is triggered, Aqua scans the code changes in the pull request automatically and displays scan results in the Code Repositories page. If you select this option, the existing code repository on which the pull request is raised will not be scanned. If you want to scan the full code repository, select the Push option.
• Push: to scan the full code repository. When a new build is triggered, Aqua scans the newly built code repository and displays scan results in the Code Repositories page.

To integrate a code repository in the source code management tool:

1. On the top right side of the Integrations page, click Connect and select CI Integrations. The CI Integration page will appear.
2. Select the repository hosting platform relevant to your organization, such as GitHub Actions or Bitbucket Pipelines. The Integration Instructions section will appear.

1. In your pipeline settings, add Aqua Key and Aqua Secret as secrets or variables. For more information on obtaining Aqua Key and Aqua Secret, refer to Generating an API Key and Secret. These secrets are required to identify the Aqua environment to which the repository will be integrated. The secrets or variables that should be added to your pipeline settings vary depending on the selected repository hosting platform, as explained below:

        2. Follow the instructions displayed on the UI for each CI build system to establish a connection with the pipeline.

        3. Select either Pull request or Push, depending on whether you want to scan the specific code changes in a pull request or full code repository. These options are visible only when you select any repository hosting platform except Jenkins and CircleCI.

       4. Copy the code block and add it to the workflow in your project or pipeline. Once the CI integration is successful, you will see the integrated code repository on the Code Repositories page.

Usage of the code block

As an example, a code block is shown below which should be added to the workflow in your Azure pipeline. Description to the important parameters is added below.

Code block:

name: Aqua
on: pull_request
jobs:
  aqua:
    name: Aqua scanner
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Run Aqua scanner
        uses: docker://aquasec/aqua-scanner
        with:
          args: trivy fs --scanners config,vuln,secret .
          # To customize which severities to scan for, add the following flag: --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
          # To enable SAST scanning, add: --sast
          # To enable reachability scanning, add: --reachability
          # To enable npm/dotnet non-lock file scanning, add: --package-json / --dotnet-proj
        env:
          AQUA_KEY: ${{ secrets.AQUA_KEY }}
          AQUA_SECRET: ${{ secrets.AQUA_SECRET }}
          GITHUB_TOKEN: ${{ github.token }}
          AQUA_URL: https://api.eu-1.supply-chain.cloud.aquasec.com
          CSPM_URL: https://eu-1.api.cloudsploit.com
          TRIVY_RUN_AS_PLUGIN: 'aqua'
          # For http/https proxy configuration add env vars: HTTP_PROXY/HTTPS_PROXY

Usage of the mandatory environment variables in the code block:

Usage of the optional arguments and the corresponding environment variables in the code block:

Usage of other optional environment variables in the code block:

As per your selection of repository hosting platform, you will see the similar code block. You can add flags and environment variables as required.

Scanning local code repositories (without source code management tool)

If your code repositories are on your local machine or a system shared by multiple users, you can scan them using the Aqua scanner image. You can scan these local repositories on a Linux machine using either Docker or Podman container engines. Execute the following Docker or Podman command after adding the necessary flags and environment variables as listed above.

Docker command

AQUA_KEY=${AQUA_KEY} AQUA_SECRET=${AQUA_SECRET} TRIVY_RUN_AS_PLUGIN=aqua 
docker run -it -e AQUA_KEY -e AQUA_SECRET -e TRIVY_RUN_AS_PLUGIN -e INPUT_WORKING_DIRECTORY=/scanning -v "${YOUR_WORKSPACE}":"/scanning" aquasec/aqua-scanner trivy fs --scanners config,vuln,secret .

Podman command

podman run --rm \
                -e AQUA_KEY=${AQUA_KEY} \
                -e AQUA_SECRET=${AQUA_SECRET} \
                -e TRIVY_RUN_AS_PLUGIN='aqua' \
                -e SAST='true' \
                -e INPUT_WORKING_DIRECTORY='/scanning' \
                -v ${WORKSPACE}:/scanning \
                docker.io/aquasec/aqua-scanner \
                git config --global --add safe.directory /scanning && trivy fs --scanners='config,vuln,secret' .

Integration with On-premises code repositories

Refer to Integration with On-Premises Code Repositories for the integration of code repositories hosted in the on-premises source code management tools.

Delete an existing integration

To delete any existing integration:

1. In the Actions column > options menu of the specific integration, click the Delete button. The Delete Integration dialog appears.

Edit an existing integration

You can edit an existing integration to change the following authentication details. To edit an integration:

1. In the Actions column > options menu of one of the following integrations, click the Edit button. The Authentication section of the integration appears.
2. Change the following authentication details as required for these integrations: