Overview

Organizations deploying Aqua Supply Chain Security often want developers to scan Infrastructure as Code (IaC) files directly from their IDE (such as Visual Studio Code) and have results appear in the Aqua console UI. Understanding the distinction between CodeSec agent-based repository scanning and IDE-local scanning is essential for setting correct expectations with development teams.

This article explains what IDE integration is available today, how CodeSec IaC scanning works, and the current limitations for pushing IDE scan results into the Aqua console.


Understanding IaC Scanning Architecture

CodeSec Agent-Based Scanning (Console Integration)

Aqua Supply Chain Security scans for on-premises code repositories require a deployed scanning infrastructure:

  • CodeSec agent — Connects repositories to Aqua
  • Connector — Bridges the agent and scanner components
  • Scanner — Performs IaC and supply chain analysis

These components must be deployed in a Docker or Kubernetes environment. Scan results from this pipeline appear in the Aqua console UI under Supply Chain Security.

Reference: Integration with On-Premises Code Repositories


IDE-Local Scanning (Aqua Trivy VS Code Extension)

Aqua provides the Aqua Trivy Visual Studio Code Extension for local scanning within the IDE. This extension enables developers to scan files and projects directly from VS Code.

Reference: Aqua Trivy Visual Studio Code Extension


Current Limitation: No Direct IDE-to-Console Integration

What Is Not Available

There is currently no supported integration that runs IaC scans within an IDE and automatically publishes those results to the Aqua Supply Chain Security UI.

Specifically:

  • IaC scanners are not designed for direct IDE deployment alongside CodeSec console integration
  • IDE scan results do not sync to the Aqua console as Supply Chain Security findings
  • No documentation or configuration exists for bridging IDE-local IaC scans into the Aqua UI

What Is Available

CapabilityIDE (VS Code Extension)CodeSec Agent Pipeline
Local IaC/file scanningYesNo (server-side)
Results in Aqua console UINoYes
Requires Docker/K8s deploymentNoYes
Repository-level continuous scanningNoYes


For Console-Visible IaC Results

  1. 1. Deploy CodeSec agent, connector, and scanner in Docker or Kubernetes per Aqua documentation.
  2. 2. Connect on-premises code repositories to Aqua Supply Chain Security.
  3. 3. Configure scan policies and schedules for repository scanning.
  4. 4. Review findings in the Aqua console under Supply Chain Security.

For Developer Workstation Scanning

  1. 1. Install the Aqua Trivy VS Code Extension on developer machines.
  2. 2. Configure the extension with a valid Aqua API key (requires Administrator to create the key).
  3. 3. Developers run local scans during development for immediate feedback.
  4. 4. Understand that local IDE results are for developer use and do not appear in the Aqua console.

Combined Workflow

A practical workflow combines both approaches:

  • Pre-commit / local: Developers use the VS Code extension for fast feedback during coding.
  • CI/CD or scheduled: CodeSec agent pipeline scans repositories and records results in the Aqua console for governance and reporting.


Verification

  1. 1. CodeSec pipeline: Confirm agent, connector, and scanner pods are running; trigger a repository scan; verify results appear in Supply Chain Security UI.
  2. 2. IDE extension: Install VS Code extension; run a local IaC scan; confirm results display in the IDE output panel.
  3. 3. Console check: After IDE-local scan, confirm results do not appear in Aqua console (expected behavior).

Important Considerations

  • Deploying CodeSec agents/scanners does not enable IDE-to-console result sync.
  • The VS Code extension and CodeSec pipeline serve different purposes — local feedback vs. centralized governance.
  • API key creation for the VS Code extension requires Administrator permissions (see Account Management → Settings).
  • Future product enhancements may expand IDE integration; refer to current Aqua documentation for the latest capabilities.


Platform Coverage

ItemDetails
ComponentSupply Chain Security
PlatformAqua SaaS
IDE SupportVS Code (Trivy extension)
Console IntegrationCodeSec agent pipeline only


Summary

QuestionAnswer
Can IaC scans run in VS Code?Yes, via Aqua Trivy VS Code Extension
Do IDE scan results appear in Aqua UI?No — not currently supported
How do IaC results appear in the console?Deploy CodeSec agent/connector/scanner and scan connected repositories
Is IDE-to-console integration documented?No — this capability does not exist today