AWS Inspector V2 Connector

Have the following ready before starting the connector configuration in Qualys ETM:

1. Ensure you have access to the AWS Management Console with permissions to create IAM roles and policies.
2. Create an IAM role with the required managed and custom policies attached (see Permissions Required below). Add the Qualys AWS user (arn:aws:iam::178650962893:user/aws-connector) to the role's trust relationships and configure an External ID.
3. Note the Role ARN from the IAM dashboard after creating the role.
4. Have your AWS Account ID and the default AWS region where Amazon Inspector is enabled.

How Authentication Works

The connector uses AWS cross-account role assumption for authentication. An IAM role with the required permissions is created in your AWS account and configured to trust the Qualys AWS user account. An External ID is automatically generated by the connector during setup in Qualys ETM for additional security. The connector assumes this IAM role to access Inspector data via AWS STS (AssumeRole).

Create an IAM Role for the Connector

1. Log in to the AWS Management Console as an administrator.
2. Navigate to Identity and Access Management (IAM).
3. From the IAM dashboard, click Roles, then click Create role.
4. Select AWS account as the trusted entity type and click Next.
5. Attach the required permissions policies based on the asset types you intend to ingest. See the Permissions Required section below for the full policy list.
6. Provide a name and description for the role, then click Create role.
7. On the Roles page, open the new role and copy the ARN value. This is the Role ARN you will enter in Qualys ETM.

Configure Trust Relationships

After creating the role, navigate to its Trust relationships tab and click Edit trust policy. Add the Qualys AWS user as a trusted principal and include the External ID condition:

• Qualys AWS User ARN: arn:aws:iam::178650962893:user/aws-connector
• External ID: Automatically generated by the connector during setup in Qualys ETM. Enter this value in the trust policy condition after the connector is created.

Permissions Required

Attach the following policies to the IAM role based on the asset types you intend to ingest.

Scope and Data Access

The connector supports four asset entity types with different ingestion capabilities:

• Compute (EC2 instances) — max page size 1,000. Asset and Vulnerability.
• Serverless (Lambda functions) — max page size 50 per AWS SDK limitation. Asset and Vulnerability.
• Container Image (ECR container images) — max page size 1,000. Asset and Vulnerability.
• Repository (ECR repositories) — max page size 1,000. Asset only.

This step establishes the connector's identity and authenticates it with your AWS account via IAM role assumption.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the AWS Inspector V2 Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for the AWS Inspector V2 connector, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens with the Before You Begin checklist and four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before continuing.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following IAM role credentials to authenticate the connector with your AWS account.

   Field	Type	Description
   Base Account ID	String	Your AWS account ID. This is the Qualys-provided base account used for cross-account role assumption. Example: 178650962893
   External ID (required)	String	The External ID automatically generated by the connector during setup. Enter this value in your IAM role's trust policy condition. Example: pod01339712824644
   Role ARN (required)	String	The Amazon Resource Name (ARN) of the IAM role the connector assumes when accessing AWS services. The role must have the required permissions and trust relationships configured. Example: arn:aws:iam::860454016470:role/qint-assume-role3
   Region (required)	String	The AWS region where Amazon Inspector is actively enabled. Example: US East (Ohio) / us-east-2. Refer to AWS Inspector supported regions.

   
   
8. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies AWS STS and Inspector endpoints are reachable.
   • TLS Handshake — Confirms a secure connection can be established.
   • Authentication Credential Check — Validates the Role ARN and External ID via STS AssumeRole.
   • Authorization Scope Check — Confirms the IAM role has the required permissions for the target asset types.
   • Data Fetch — Verifies that asset and finding data can be retrieved from the AWS Inspector API.

   All five checks must pass before you can proceed. See the Troubleshooting section if any check fails.

   
9. Click OK to dismiss the modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — Select one of the following:
   • Assets & Findings — Ingests both asset records and associated CVE-based vulnerability findings.
   • Assets — Ingests asset records only, without vulnerability findings.
2. Advanced Settings (optional) — Click Advanced Settings to restrict which asset types are ingested or to view the active transform map. See Advanced Settings below.
3. Schedule — Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

   Note: The timezone is determined by your Qualys account settings. The connector runs from the configured start date for a default period of 5 years.

4. Click Next. Review and confirm the changes.
   
5. Click Create.