Overview


API keys (AQUA_KEY and AQUA_SECRET) used for Supply Chain Security CI integrations require specific role permissions in the Aqua platform. Understanding which permissions are mandatory—and why certain permissions are automatically linked—helps security teams apply least-privilege access when creating integration credentials.

This article explains the required permissions for CI integration API keys, why View access to Code Repositories is automatically granted with Scan permission, and what API operations are possible with this permission set.


Required Permissions for CI Integration

To create API keys for Supply Chain Security CI integrations, assign a custom role with the following permissions under Supply Chain Security:

PermissionAccess LevelRequired
ScanEditYes
Code RepositoriesViewYes (automatically linked)


The Scan permission with Edit access is the primary permission required to trigger code repository scans from CI pipelines.


Why View Permission for Code Repositories Is Automatically Assigned

When Scan (Edit) is enabled in the role configuration, View permission for Code Repositories is automatically granted. This is by design—not an unnecessary permission assignment.

Scanning a code repository requires the API to retrieve repository details (name, URL, branch configuration, integration settings) before executing a scan. Without View access to Code Repositories, the scan operation cannot access the repository metadata it needs to run.

The CI integration documentation specifies that the Scan permission is required; enabling Scan implicitly requires the linked View permission for Code Repositories.

API Operations Available with This Permission Set

With Scan (Edit) and Code Repositories (View) permissions, an API key can:

  • View code repository configurations and metadata
  • Trigger scans on existing integrated repositories

An API key with only these permissions cannot:

  • Create, modify, or delete code repositories
  • Modify scan policies or integration settings
  • Access Workload Protection, runtime policies, or other Aqua modules
  • Perform administrative operations

If an API key were exposed, the blast radius is limited to viewing repository metadata and triggering scans on repositories already integrated—not creating new integrations or modifying platform configuration.

Configuring the Role and API Key

Step 1: Create a Custom Role

  • Navigate to Administration → Roles in the Aqua console.
  • Create a new role (for example, SCS-CI-Scanner).
  • Under Supply Chain Security, enable:

            - Scan — Edit

            - Code Repositories — View (auto-assigned when Scan Edit is enabled)

Do not grant additional Supply Chain Security or platform permissions unless explicitly required.

Step 2: Create the API Key

  • Navigate to Administration → API Keys (or Integrations → API Keys).
  • Create a new API key.
  • Assign the custom role created in Step 1.
  • Copy AQUA_KEY and AQUA_SECRET for use in CI pipeline environment variables.

Step 3: Configure CI Pipeline

Set the API credentials in your CI pipeline per the integration guide:

variables:
  AQUA_KEY: $AQUA_API_KEY
  AQUA_SECRET: $AQUA_API_SECRET

Documentation: CI Integrations – Aqua Docs

Important Considerations

  • Scan alone is not sufficient: Although Scan is the operationally required permission, View for Code Repositories is a technical prerequisite that cannot be removed.
  • Least privilege within SCS: The Scan + Code Repositories View combination is the minimum effective permission set for CI scanning—not a broader administrative role.
  • Separate keys per integration: Create dedicated API keys for CI integrations rather than reusing administrative credentials.

Verification

  • Create a test API key with only Scan (Edit) and verify Code Repositories (View) is auto-assigned.
  • Run a CI pipeline scan using the API key and confirm results appear in Supply Chain Security.
  • Attempt an unauthorized operation (for example, deleting a repository) with the same key and confirm it is denied.
  • Review API audit logs to confirm only scan and repository-read operations occur.

Platform Coverage

  • Product: Aqua SaaS, Aqua Enterprise
  • Module: Supply Chain Security
  • Integration Type: CI integrations (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, etc.)