Amazon Inspector V2 Connector

The Amazon Inspector API Connector bridges AWS Inspector and Qualys ETM to consolidate vulnerability findings from your cloud infrastructure into a centralized risk management platform. By automatically pulling EC2 instance, ECR container images and Serverless Lamda functions and its vulnerabilities and deduplicating data through normalizing data formats and enriching findings with additional context, security teams gain unified visibility into their AWS security posture rather than managing assessments across separate tools. The connector calculates risk scores using TruRisk and enables faster remediation by combining cloud vulnerabilities with on-premises findings in one system. This integration transforms AWS vulnerability discovery from an isolated assessment into an actionable component of enterprise-wide threat and risk management.

This connector supports Amazon Inspector V2 only. Amazon Inspector Classic is not supported. AWS China regions and AWS GovCloud regions are not supported in the current implementation.

Connector Details

The following table provides a summary of what the Amazon Inspector V2 Connector supports.

Connection Settings

User Roles and Permissions

The connector uses IAM role-based authentication via AWS Secure Token Service (STS) AssumeRole. The IAM role must be configured in your AWS account and must include the following managed and inline policies depending on the asset types you intend to ingest.

To allow the connector to assume the role, add the Qualys-provided AWS user account to the Trust Relationships of the IAM role and configure an External ID for additional security.

• Qualys Provided AWS User Account: arn:aws:iam::178650962893:user/aws-connector
• Base Account ID: 178650962893

Create a role and assign permissions

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the IAM dashboard, click Roles, and then click Create role.

4. Choose AWS account for the Trusted entity type and click Next.

5. Search for and select the AmazonInspectorReadOnlyAccess permission from the list of permissions and click Next.

6. Assign a name and description and then click Create role.

7. Back on the Roles page, click the new role and copy the value in the ARN field.

If you do not have permissions to create IAM roles, contact your AWS administrator. Refer to AWS documentation for details.

Authentication Details

Provide the following credentials in the connector configuration screen:

How to Get Prerequisites Data in AWS

Create a Role and Assign Permissions

1. Log in to your AWS Management Console as an administrator.
2. Navigate to Identity and Access Management (IAM).
3. From the IAM dashboard, click Roles, then click Create role.
4. Choose AWS account as the Trusted entity type and click Next.
5. Search for and select AmazonInspector2ReadOnlyAccess from the permissions list and click Next.
6. Assign a name and description, then click Create role.
7. On the Roles page, open the new role and copy the ARN value. This is used as the assumeRoleArn in the connector configuration.

   Display the partial Role ARN value only. Do not expose the full ARN in public-facing documentation.

8. Attach any additional required policies (Lambda, ECR) as inline customer policies to the same role based on the asset types you are ingesting. Refer to the Permissions table above.
9. Under the Trust relationships tab of the role, add the Qualys-provided AWS user account (arn:aws:iam::178650962893:user/aws-connector) as a trusted principal and configure the External ID condition.

Connector Configuration

Basic Details

1. Log in to Qualys ETM.
2. Go to Connectors > Integration tab and locate the Amazon Inspector V2 Connector.
3. Click Manage from the ellipsis menu.
4. Provide a Name and Description for the connector.
5. Select the supported findings type: Vulnerability / Host Asset.
6. Enter the Default Region, Assume Role ARN, and External ID.
7. Click Save to create the connector.

Mapping Details

Data Model

The Amazon Inspector V2 Connector provides out-of-the-box data model mappings for all four supported asset types, with or without associated vulnerabilities. The connector supports the following object-to-data-model relationships:

View the full data models in ETM to understand all supported and optional fields.

Transform Maps

Default transform maps are provided for each asset type. You can create new maps or clone existing ones to customize field transformations.

Data Model Mapping – AWS EC2 Instance (Asset Transformation)

Data Model Mapping – AWS Lambda Serverless Function (Asset Transformation)

Data Model Mapping – AWS ECR Repository (Asset Transformation)

Data Model Mapping – AWS ECR Container Image (Asset Transformation)

Data Model Mapping – AWS EC2 Vulnerability Transformation

Data Model Mapping – AWS Lambda Vulnerability Transformation

Data Model Mapping – AWS ECR Container Image Vulnerability Transformation

Profiles

Profiles control the execution schedule and transform map assignment for the connector.

1. Click + to add a new profile.
2. Provide a Name and Description.
3. Select the required Transform Map.
4. Set Status (Active or Inactive).
5. Configure a Schedule: Single Occurrence or Recurring with start and end dates/times.

Identification Rules

Identification Rules are provided out-of-the-box by Qualys CSAM. They control how vulnerability findings are matched to assets during ingestion. At least one rule must be active. You may proceed without modification in most environments, but review active rules to confirm they align with your asset identification strategy for cloud workloads.

How Does a Connection Work?

The Amazon Inspector V2 Connector executes on schedule (based on the configured profile) or on demand. On each run, it authenticates to AWS via STS AssumeRole using the configured ARN and External ID, then calls the AWS Inspector V2 and EC2 APIs to retrieve assets and findings. Data is mapped through the configured transform map and imported into ETM.

The following APIs are called during execution:

The ListFunctions API is limited to 50 results per call by AWS. The connector handles pagination automatically to retrieve all Lambda functions.

The connector state transitions from Registered to Scheduled, then Processing, and finally Processed upon successful completion. The connector state is visible in the Connectors screen in ETM.

Viewing Assets and Findings in ETM

After a successful connector run, Amazon Inspector V2 assets and findings appear in ETM:

• Assets: Go to Inventory > Assets > Host. Filter with tags.name:"AWS Inspector".
  
• Findings: Go to Risk Management > Findings > Vulnerability. Filter with finding.vendorProductName:"Amazon Inspector".
  

API Endpoint

The connector does not use REST APIs to fetch the assets or findings from Amazon Inspector. Instead. Instead, the Amazon Inspector connector uses the AWS SDK version 2.42.4. 

Assumptions and Limitations

• This connector supports Amazon Inspector V2 only. Amazon Inspector Classic is not supported.
• AWS China regions and AWS GovCloud regions are not supported.
• Organization-level multi-account setup is not supported in the current implementation.
• The ListFunctions API supports a maximum of 50 functions per call. Paginated calls retrieve all available functions automatically.
• Delta poll/fetch support is available only for the ListFindings API (vulnerability ingestion). Asset ingestion performs a full pull on each run.
• For ECR scanning, AWS Inspector V2 can only scan container images stored in AWS ECR private registries and repositories. Public registries are not supported. See AWS documentation on ECR scanning.