Create AWS Connectors (2024)

Provide a name and description for the connector. We recommendyou provide a unique name for the connector.

Select applications that are applicable for the connector.

Select Enable Remediation to enable remediation on the connector. You need to configure additional permissions before you enable remediation for AWS connectors.

Note: Ensure that the connector has write access tothe AWS account for which you enable remediation.Refer to Configuring Remediation for AWS.

Account Type

Select an account type for your connector: Global, US GovCloud, or China. You can choose only one account type per connector.

Polling Frequency

Select a frequency at which the connector should poll the cloud provider and fetch data.

By default, the connector polling frequency is configured for every 4 hours. As a result, the connector connects with the cloud provider every 4 hours to fetch the data.

You can configure frequency from one hour to a maximum of 24 hours. We recommend configuring a frequency of 4 hours or more for optimal use of your connector. Configuring a low polling frequency (less than 4 hours) can affect the connector's performance and may result in AWS API throttling error.

Cross-account ARN

This lets you grant Qualys access to your AWS resources without sharing your AWS security credentials. Qualys accesses your AWS resources by assuming the IAM role you create in your AWS account.Learn more.

AWS requires that vendors provide a unique external ID value amongst all their customers when providing a vendor account for a trust relationship. However, we no longer require customers to adhere to any fixed format for external IDs.Learn more

You must provide an external ID to download a valid template while creating a role using CloudFormation.

In the Application list, select TotalCloud/AssetView,paste Role ARN, and click Add.

Test Connection

Click Test Connectionto verify if the connector can successfully authenticate using the provided role ARN information. If the test connection is successful, proceed with the connector creation process. If the test connection fails, you may need to check and update the authentication details.

Select regions to discover the asset/resource and fetch the data from all the selected regions.

Note:Region selection is only applicable for AV connectors. CSPM connectors will continue to show resources for all the regions even if a few regions are selected while creating connectors.

We can activate AWS assets for scanning automatically, so you do nothave to take this extra step. Select the required check box to enable activation for the required app. We automatically activate the assets as they are discovered and even assign them tags if you want.

Enabling Cloud Perimeter Scan

When you select theAutomatically activate all assets for VM Scanning application check box, you can see a check box to enable cloud perimeter scan.

Select the Enable Cloud Perimeter Scan if you want to enable launching perimeter scans on your EC2 assets.

Perimeter scan jobsare run automatically based on the settings defined in the Scan Settings step or in theCloud Perimeter Scan - Global Scan Configuration.

Enabling Zero-touch API Based Scan

When you select theAutomatically activate all assets for VM Scanning application check box, a check box to enable zero-touch API based scan becomes visible.

Select the Enable Zero-touch API based Scan if you want to utilize cloud native API to perform real-time vulnerability assessments on new EC2 instances.

The API scan captures events from your AWS environment in real-time to identify new instances in the cloud inventory. To allow Qualys to listen to events in your AWS account for API scanning, refer toConfigure Zero-touch API-based Assessment.

Select Asset Tags

We recommend you create at least one generic asset tag (for example, EC2) and have the connector automatically apply that tag to all imported assets. You can add more tags to your EC2 assets based upon discovered EC2 metadata.

The step for defining scan settings is available only if you selectthe Enable Cloud Perimeter Scan check box in the Tags and Activation step.

In this step, you can define customized settings for cloud perimeter scans for the specific connector that you are creating.

If you do not define the custom scan configuration for the connector, the global scan configuration is used for launching the cloud perimeter scan. For details on global scan configuration, seeCloud Perimeter Scan - Global Scan Configuration.

Select the Enable custom scan configuration check box. You can define scan settings, such asscan prefix, option profile, recurrence, and timezone.

For details of the scan settings fields, seeCloud Perimeter Scan - Global Scan Configuration.

The AWS assets are detected by EC2 connector and/or Cloud Agent. The status in asset records from the EC2 connector is updated with every connector run. However, if an asset in terminated, only the asset records from EC2 connector reflects the terminated status after connector run.

The asset records from Cloud Agent running in AWS and instances from EC2 connector are automatically merged into a single asset record and it correctly reflects the status. The asset records from Cloud Agent, which are not merged with record fetched via connector does not reflect the terminated status.