Aqua Security Expert

Aqua Platform Components

Overview

Aqua Security provides end-to-end container lifecycle security:

Source Code                CI/CD Pipeline              Production Runtime
     │                          │                              │
Trivy/Checkov          Aqua Scanner + Trivy          Aqua Enforcer
(IaC + SCA)            (Image scanning,              (Runtime protection,
                         secrets, misconfigs)          drift prevention)
                               │                              │
                        Image Assurance Policy        Runtime Policy
                        (block/allow/warn)             (allow/alert/block)
                               │                              │
                        Aqua Console (unified visibility, policy management, compliance)
                               │
                        KSPM (Kubernetes Security Posture Management)
                        (kube-bench, CIS benchmark, config assessment)

Aqua Console

Central management and visibility platform:

• SaaS or self-hosted (on Kubernetes)
• Aggregates all scan results, runtime events, and compliance data
• Policy management (image assurance, runtime, container firewall, host compliance)
• RBAC for multi-team environments
• API for programmatic access and SIEM/SOAR integration

Trivy (Open Source Scanner)

Trivy is Aqua's open-source vulnerability scanner — the most widely adopted container scanner:

Trivy scan targets:

# Container image (local or remote)
trivy image python:3.11-slim

# Filesystem / source code directory
trivy fs /path/to/project

# Git repository
trivy repo https://github.com/myorg/myapp

# Kubernetes cluster
trivy k8s cluster --report summary

# Kubernetes specific namespace
trivy k8s --namespace production --report all

# Specific SBOM file
trivy sbom myapp-sbom.spdx.json

Trivy scanner types (--scanners flag):

• vuln — Vulnerability detection (CVEs) — default
• secret — Hardcoded secrets (API keys, passwords, tokens)
• config — Misconfigurations in Docker, Kubernetes, Terraform, CloudFormation
• license — License compliance
• sbom — SBOM generation

Trivy vulnerability databases:

• OS packages: GitHub Advisory Database + OS vendor advisories (Ubuntu USN, RedHat RHSAs, Alpine SecDB, etc.)
• Language packages: GitHub Advisory Database, PyPI, NPM, Maven, NuGet, Cargo, Go

Trivy CI/CD integration:

# GitHub Actions: Scan and upload to GitHub Security tab
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    format: sarif
    output: trivy-results.sarif
    severity: CRITICAL,HIGH

- name: Upload Trivy scan results to GitHub Security tab
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: trivy-results.sarif

Aqua Enterprise Scanner: Built on Trivy but adds:

• Policy enforcement (Image Assurance Policies)
• Results stored in Aqua Console with history
• Advanced secrets detection
• Malware detection
• DTA (Dynamic Threat Analysis) integration
• SLA tracking

Image Assurance Policies

Aqua's policy framework for determining whether an image is allowed to run:

Policy checks:

• CVE severity thresholds (block on CRITICAL, warn on HIGH)
• CVE fix availability (block only if a fix is available)
• Sensitive data (secrets, PII) in the image
• Malware detected
• Base image age (block images older than X days)
• Root user check (block images running as root)
• Trusted base image (must be from approved base image list)
• Image registry (must be from approved registries only)
• Image signing (must have valid signature from trusted key)
• Custom compliance checks

Policy enforcement actions:

• Warn — Log the violation; allow deployment
• Block — Prevent deployment (CI/CD gate or admission controller)
• Audit — Allow but log all violations for review

# Example Image Assurance Policy (via Aqua API or UI)