---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# AWS Integration for Security Exposure Management

# AWS Integration for Security Exposure Management {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of AWS Integration for Security Exposure Management

The AWS Integration for Security Exposure Management connects your AWS environment to the ServiceNow AI Platform®, enabling the import of security findings from AWS Inspector and AWS Security Hub.
This integration helps streamline vulnerability management by automating the ingestion and correlation of security data from AWS services into ServiceNow.
Show full answer Show less  

## Supported Integrations

* **AWS Inspector:** An automated vulnerability management service scanning EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure. The integration uses this data to prioritize and remediate vulnerabilities.
* **AWS Security Hub:** Centralizes security alerts and compliance status across AWS accounts, providing unified visibility. The integration imports host and container vulnerabilities, as well as asset misconfigurations.

## Key Features

* Multi-regional data ingestion from multiple AWS regions configured by the customer.
* Delta imports retrieve only updated findings since the last integration run, improving efficiency.
* Mapping of AWS findings to ServiceNow Vulnerable Items (VITs), Container Vulnerable Items (CVITs), detections, and Configuration Compliance test results.
* Configuration item (CI) mapping and asset correlation to enhance data accuracy.
* Uniqueness enforcement to avoid duplicate records.
* Domain separation and support for split detection in host findings.

## Integration Schedules and Types

All integrations run daily by default. Available integrations include:

* **AWS Inspector Host Vulnerability Integration:** Retrieves host vulnerabilities for EC2 instances and Lambda functions, creating VITs and detections.
* **AWS Inspector Container Vulnerability Integration:** Retrieves container vulnerabilities for ECR images, creating CVITs and findings.
* **AWS Security Hub Host Vulnerability Integration:** Imports host vulnerability findings, creating VITs and detections.
* **AWS Security Hub Container Vulnerability Integration:** Imports container vulnerabilities, creating CVITs and findings.
* **AWS Test Results Integration:** Retrieves asset misconfigurations, creating tests and results in Configuration Compliance.

## Authentication

The integration authenticates with AWS using IAM credentials and AWS Signature Version 4 (SigV4) request signing. For cross-account access, a Role ARN can be configured to use AWS STS AssumeRole, granting temporary credentials valid for 3,600 seconds.

## Credential Configuration

Key fields for AWS credentials include:

* **Access Key:** AWS IAM user access key ID.
* **Secret Key:** Encrypted AWS secret access key.
* **Role ARN:** ARN of the IAM role for cross-account access via STS AssumeRole.
* **Region:** One or more AWS regions to retrieve findings from.

This integration enables ServiceNow customers to efficiently import and manage AWS security findings, improving vulnerability remediation workflows and compliance visibility across AWS assets.  
AWS Integration for Security Exposure Management connects your AWS environment to your ServiceNow AI Platform®, enabling you to import security findings from AWS Inspector and AWS Security Hub.

## Supported integrations {#aws-integration-for-security-exposure-management-overview__section_integration_types}

The AWS Integration for Security Exposure Management supports integrations with the following AWS services:

AWS Inspector
:   AWS Inspector is an automated vulnerability management service that continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities (CVEs)
    and unintended network exposure. The Vulnerability Response integration with AWS Inspector uses data imported from AWS Inspector to help you prioritize and remediate vulnerabilities for your assets.

AWS Security Hub
:   AWS Security Hub is a security service that is used to centralize and update security checks across AWS accounts. It provides a unified view of security alerts and compliance status by integrating with various AWS services. The Vulnerability Response integration with AWS Security Hub imports Host, Container vulnerabilities, and misconfigurations from AWS Security Hub.

## Key features {#aws-integration-for-security-exposure-management-overview__section_supported_use_cases}

AWS Integration for Security Exposure Management includes the following key features:

* Multi-regional data ingestion from multiple configured AWS regions.
* Delta imports for all integrations, retrieving only updated findings since the last integration run.
* Mapping of AWS Security Hub and Inspector host findings to vulnerable Items (VIT)s and detections, container findings to Container Vulnerable Items (CVIT)s, and test results in Configuration Compliance.
* Configuration item (CI) mapping and asset correlation.
* Uniqueness enforcement to help avoid duplicate records.
* Domain separation.
* Split detection support for host findings.
{#aws-integration-for-security-exposure-management-overview__ul_gjx_n24_53c}

## Integration schedules {#aws-integration-for-security-exposure-management-overview__section_integration_schedules}

All integrations run on a daily schedule by default. The following integrations are available:
{#aws-integration-for-security-exposure-management-overview__table_integration_schedules__entry__2}

| Integration | Description |
|-|-|
| AWS Inspector Host Vulnerability Integration | Retrieves host vulnerability findings for EC2 instances and Lambda functions. Creates Vulnerable Items (VIT)s, discovered items, and detections. |
| AWS Inspector Container Vulnerability Integration | Retrieves container vulnerability findings for ECR container images. Creates Container Vulnerable Items (CVIT)s, discovered container images, and Findings. |
[Table 1. Available AWS Inspector integrations]

{#aws-integration-for-security-exposure-management-overview__table_integration_schedules} {#aws-integration-for-security-exposure-management-overview__section_integration_schedules__entry__8}

| Integration | Description |
|-|-|
| AWS Security Hub Host Vulnerability Integration | Retrieves host vulnerability findings (EC2 Instances, Lambda Functions) from AWS Security Hub. Creates vulnerable items (VIT)s, discovered items, and detections. |
| AWS Container Vulnerability Integration | Retrieves container vulnerability findings (ECR Container Images) from AWS Security Hub. Creates Container Vulnerable Items (CVIT)s, discovered container images, and Findings. |
| AWS Test Results Integration | Retrieves misconfigurations of various assets from AWS Security Hub. Creates tests and test results in Configuration Compliance. |
[Table 2. Available AWS Security Hub integrations]

## Authentication {#aws-integration-for-security-exposure-management-overview__section_authentication}

The integration authenticates with AWS using IAM credentials and AWS Signature Version 4 (SigV4) request signing. When you configure a Role ARN, the integration calls AWS STS AssumeRole to obtain temporary security credentials, which are valid for 3,600 seconds.
{#aws-integration-for-security-exposure-management-overview__table_credential_fields__entry__2}

| Field | Description |
|-|-|
| Access Key | AWS access key ID for the IAM user. |
| Secret Key | AWS secret access key (stored encrypted). |
| Role ARN | ARN of the IAM role for STS AssumeRole (required for cross-account access). |
| Region | One or more AWS regions from which to retrieve findings. |
[Table 3. AWS credential fields]

{#aws-integration-for-security-exposure-management-overview__table_credential_fields}