Create AWS Connector

Provide a name and description for the connector. We recommend you provide a unique name for the connector.

Select applications that are applicable for the connector. 

Select Enable Remediation to enable remediation on the connector. You need to configure additional permissions before you enable remediation for AWS connectors. 

Note: Ensure that the connector has write access to the AWS account for which you enable remediation.

Select an account type for your connector: Global, US GovCloud or China. You can choose only one account type per connector.

Select a frequency at which the connector should poll the cloud provider and fetch data.

By default, the connector polling frequency is configured for every 4 hours. As a result, the connector connects with the cloud provider every 4 hours to fetch the data.

You can configure frequency from minimum one hour to maximum 24 hours. We recommend that you configure a frequency of 4 hours or more for optimal use of your connector. Configuring a low polling frequency (lesser than 4 hours) can affect the performance of the connector and may result in AWS API throttling error.

This lets you grant Qualys access to your AWS resources without sharing your AWS security credentials. Qualys accesses your AWS resources by assuming the IAM role that you create in your AWS account. Learn more.

AWS requires that vendors provide a unique external ID value amongst all their customers when providing a vendor account for a trust relationship. However, we no longer require customers to adhere to any fixed format for external ID. Learn more 

In the Application list, select CloudView/AssetView, paste Role ARN, and click Add.

Click Test Connection to verify if the connector can successfully authenticate using the provided role ARN information. If the test connection is successful, proceed with the connector creation process. If the test connection fails, you may need to check and update the authentication details.

 

Note: The next steps are enabled only after the test connection is successful.

 

Select regions to discover the asset/resource and fetch the data from all the selected regions. 

Note: Region selection is only applicable for AV connectors. CV connectors will continue to show resources for all the regions even if a few regions are selected while creating connectors.

We can activate AWS assets for scanning automatically so you do not have to take this extra step. Select the required check box to enable activation for the required app. We automatically activate the assets as they are discovered and even assign them tags if you want. 

Enabling Cloud Perimeter Scan 

When you select the Automatically activate all assets for VM Scanning application check box, you can see a check box to enable cloud perimeter scan. 

Select the Enable Cloud Perimeter Scan if you want to enable launching perimeter scans on your EC2 assets. 

Perimeter scan jobs are run automatically based on the settings defined in the Scan Settings step or in the Cloud Perimeter Scan - Global Scan Configuration.

Enabling Zero-touch API Based Scan

When you select the Automatically activate all assets for VM Scanning application check box, a check box to enable zero-touch API based scan becomes visible. 

Select the Enable Zero-touch API based Scan if you want to utilize cloud native API to perform real-time vulnerability assessments on new EC2 instances. 

The API scan captures events from your AWS environment in real-time to identify new instances in the cloud inventory. To allow Qualys to listen to events in your AWS account for API scanning, refer to Configure Zero-touch API Based Scan.

Select Asset Tags

We recommend you create at least one generic asset tag (for example, EC2) and have the connector automatically apply that tag to all imported assets. You can add more tags to your EC2 assets based upon discovered EC2 metadata.

The step for defining scan settings is available only if you select the Enable Cloud Perimeter Scan check box in the Tags and Activation step. 

In this step, you can define customized settings for cloud perimeter scans for the specific connector that you are creating.

If you do not define the custom scan configuration for the connector, the global scan configuration is used for launching the cloud perimeter scan. For details on global scan configuration, see Cloud Perimeter Scan - Global Scan Configuration.

Select the Enable custom scan configuration check box. You can define scan settings, such as scan prefix, option profile, recurrence, and timezone. Show meShow me

For details of the scan settings fields, see Cloud Perimeter Scan - Global Scan Configuration.

Assign tags to the connector that you are creating. You can also create a new tag. For details on creating new tags, see Configure Tags in Qualys CyberSecurity Asset Management documentation. 

Review the connector settings you configured and then click Create Connector.

Your EC2 instances may have IP address changes. We can continue to scan your EC2 instances because we scan by EC2 instance ID (not by IP address). If changes are found by an EC2 scan, you can see the new IP addresses in your scan results. Once these scan results are processed the new IP addresses are shown in your account and is included in your scan reports.

AWS assets: Status and BehaviorAWS assets: Status and Behavior