Cloud security
What Vulnetix reads from a connected AWS account, what it deploys there, how Wiz findings are checked against the account, and where each result appears in the console.
Cloud security connects your AWS accounts to Vulnetix. A small function, the probe (vulnetix-security-reporter), runs inside each account, enumerates its resources, and reports findings that name a resource ARN and the CVE or control it fails. The probe is the only thing that reads your account’s data. Vulnetix assumes a role in the account to deploy and maintain it, and to start a sweep.
What you get
| Result | Where it appears | Needs |
|---|---|---|
| Cloud findings: a named ARN affected by a named CVE, with the CRIT criteria evaluated and what they saw | Resolve > Cloud (/resolve/cloud) |
An AWS connection |
| Runtime findings: OS packages, EMR, EKS and ECS images, CIS AWS Foundations controls, CloudFormation template checks | Resolve > Runtime (/resolve/runtime) |
The Compute runtime source |
| AWS WAF posture: web ACLs, rules, managed rule group versions, what each ACL protects | Virtual patching, WAF tab | The AWS WAF source |
| Amazon Inspector, Security Hub, GuardDuty, Config, Macie and IAM Access Analyzer findings, each under its own product name | The findings queue and each product’s integration card | That product’s source |
| Wiz issues and vulnerability findings, each with a second verdict from inside the account | The findings queue, beside the Wiz claim | An AWS connection and a Wiz connection |
Every cloud finding is an ordinary finding (category cloud), so triage, suppressions, VEX and exports work on it unchanged.
How it fits together
- You connect an account from Integrations > AWS in the console, with IAM Identity Center or, for accounts without it, an IAM user access key. See Connect with IAM Identity Center.
- Vulnetix deploys two CloudFormation stacks into the account:
vulnetix-security-bootstrap(a CloudTrail bucket and the cross-account role) andvulnetix-security-pipeline(a multi-region trail, an EventBridge rule, an SQS queue, a secret and the probe). See What Vulnetix deploys. - Vulnetix invokes the probe on a schedule: daily, staggered across a 4-hour window. The probe reads the account, looks up CRIT criteria from the VDB API and posts its findings back.
- Each extra source you turn on attaches one named, read-only inline policy to the probe’s role on the next stack deploy. See Cloud-native sources.
Plan
Cloud integrations (AWS, the AWS-native sources and Wiz) need the Pro plan or above. On a lower plan the console shows the drawer locked with an upgrade link.
Related
- Ship VPC flow, Resolver and CloudTrail logs to the Vulnetix SIEM: Guardian AWS log shipping.
- Deploy virtual patches to AWS WAF: /virtual-patching/.
- The runtime sensor that runs on your hosts and containers: Vulnetix sensor.
Platform IaC
The AWS connection, its accounts, which native sources are read, and the Wiz connection are kinds: AwsConnection, AwsAccount, CloudSensors and WizConnection. The config engine applies them, and the Terraform resources and the AWS modules are on Terraform and OpenTofu. An IAM Identity Center connection reports AwaitingAuthorization until someone approves the sign-in; see status phases.
When Drift protection is on, a change made in the console or through a legacy API to an AWS connection, AWS account or cloud sensors that is managed as code (by Terraform or a repository) is refused with HTTP 409 managed_by_platform_iac. Change it where it is declared, or ask an admin to turn Drift protection off.