2023 March SaaS Update Release
The March 2023 SaaS Update Release includes the following changes with respect to the previous SaaS product release. Unless otherwise stated, all updates were made available on March 19.
TABLE OF CONTENTS
- Aqua Platform
- Supply Chain Security
- Workload Protection
- Security enhancement to names of image registries created automatically by KubeEnforcer
- Enhancement to Kubernetes Assurance Policies
- Setting to enable/disable container engine audit event logging
- Additional support of OS vendors in Aqua Trivy Premium Scanner
- Common Weakness Enumeration (CWE) information in Vulnerability details screen
- Support of token-based authentication in Azure DevOps plugin
- Pod Enforcer and Aqua Enforcer can coexist in EKS clusters
Aqua Hub Inventory Resource Overview displays Top Insights and Top Incidents
In the Aqua Hub Inventory page, on clicking any resource, the top three insights and incidents of the highest severity reported for the resource are displayed in the Resource Overview pane. Upon clicking any insight or incident in this pane, its detailed view is displayed.
Supply Chain Security
Issues tab in the Dependency detailed view
In the Dependencies page, each Dependency detailed view includes the new Issues tab, which shows the list of all security issues detected in the current package.
Security enhancement to names of image registries created automatically by KubeEnforcer
- When the "Add discovered registries" setting is enabled in the KubeEnforcer group settings, the KubeEnforcer will add previously unknown image registries from the cluster to Aqua with the name registryurl_username to prevent exposing Kubernetes namespace and secret names. (Previously, registries were added with the name namespace_secretname.)
- However, if you set the optional KubeEnforcer environment variable AQUA_REG_INTEGRATION_WITH_SECRET_NAME to true, the KubeEnforcer will add the image registries with the name namespace_secretname as it did before this enhancement was made.
Enhancement to Kubernetes Assurance Policies
When setting additional scope criteria for Kubernetes Assurance Policies, the following Kubernetes attributes are available for selection: Clusterrole, Clusterrolebinding, and Resourcename.
Setting to enable/disable container engine audit event logging
In the Settings > Enforcer page:
- The "Audit Enforcer Connection and Disconnection" section has been renamed "Enforcer Audit Event Settings".
- A new checkbox, "Log container engine lifecycle events (e.g., container start/stop)", has been added to this section. This checkbox allows you to enable or disable auto-reporting of the container engine's lifecycle audit logs. By default, this checkbox is disabled.
Additional support of OS vendors in Aqua Trivy Premium Scanner
Aqua Trivy Premium now also supports the following Operating System (OS) vendors:
- Alma Linux
- Oracle Linux
- Rocky Linux
Common Weakness Enumeration (CWE) information in Vulnerability details screen
In the Vulnerability detail screen for the selected image, you can view details of the CWE ID for a particular CVE. Each CVE can have multiple CWEs mapped. CWE details are added for the images scanned by either the Classic or the Trivy Premium scanner.
Support of token-based authentication in Azure DevOps plugin
The Aqua Azure DevOps plugin for image scanning can now also use token-based support for authentication (in addition to username/password authentication) in the "Service Connection" settings of a DevOps project.
Pod Enforcer and Aqua Enforcer can coexist in EKS clusters
In an EKS cluster, even when an Aqua Enforcer has already been deployed on any EC2 node, it is possible to inject a Pod Enforcer into any Fargate node.
Did you find it helpful? Yes NoSend feedback