---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Integrations

# AWS Integration for Security Exposure Management integrations {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Integrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.

## Required roles {#aws-sem-integrations__section_roles}

Users who configure and use the integration must be assigned the appropriate ServiceNow roles.

sn_vul_aws.configure_integration
:   Allows you to configure authentication credentials for the AWS plugin.

sn_vul_aws.read_integration
:   Provides read access to AWS integrations and AWS tables.

## Dependencies {#aws-sem-integrations__section_dependencies}

AWS Integration for Security Exposure Management requires the following ServiceNow® applications:

* **Vulnerability Response** (required) --- Core application for vulnerability management.
* **Container Vulnerability Response** (optional) --- Required for the AWS Inspector Container and AWS Security Hub Container integrations.
* **Configuration Compliance** (optional) --- Required for the AWS Security Hub Test Results integration.
{#aws-sem-integrations__ul_hjx_n24_53c}

## AWS Inspector Integrations {#aws-sem-integrations__section_c3n_2w4_53c}

{#aws-sem-integrations__table_kxb_jw4_53c__entry__3}

| Integration | Description | Run sequence and frequency |
|-|-|-|
| AWS Inspector Host Vulnerability Integration | * Retrieves all host vulnerability findings from AWS Inspector for EC2 Instances and Lambda Functions. * Uses API: POST /findings/list. * Supports delta synchronization using 'updatedAt' filter * Uses 'nextToken' and 'maxResults' for pagination. * Creates vulnerable items (VIT)s, discovered items, and Detections. {#aws-sem-integrations__ul_uhp_nw4_53c} | First, Daily. |
| AWS Inspector Container Vulnerability Integration | * Retrieves all container vulnerability findings from AWS Inspector for ECR Container Images. * Uses API: POST /findings/list. * Supports delta synchronization using 'updatedAt' filter * Uses 'nextToken' and 'maxResults' for pagination. * Creates container vulnerable items (CVIT)s, discovered container images, and Findings. {#aws-sem-integrations__ul_dzj_vw4_53c} | Second, Daily. |
[Table 1. AWS Inspector integration details]

{#aws-sem-integrations__table_kxb_jw4_53c}

## AWS Security Hub Integrations {#aws-sem-integrations__section_zzd_x54_53c}

{#aws-sem-integrations__table_rvc_y54_53c__entry__3}

| Integration | Description | Run sequence and frequency |
|-|-|-|
| AWS Security Hub Host Vulnerability Integration | * Retrieves host vulnerability findings (EC2 Instances, Lambda Functions) from AWS Security Hub. * Uses API: POST /findingsv2. * Supports delta synchronization using 'finding_info.modified_time_dt'. * Uses 'maxResults' and 'nextToken' for pagination. * Creates vulnerable items (VIT)s, discovered items, and detections. {#aws-sem-integrations__ul_fs4_rv4_53c} | First, Daily. |
| AWS Security Hub Container Vulnerability Integration | * Retrieves container vulnerability findings (ECR Container Images) from AWS Security Hub. * Uses API: POST /findingsv2. * Supports delta synchronization using 'finding_info.modified_time_dt' * Creates container vulnerable items (CVIT)s, discovered container images, and Findings. {#aws-sem-integrations__ul_h4n_5v4_53c} | Second, Daily. |
| AWS Security Hub Test Results Integration | * Retrieves misconfigurations of various assets types from AWS Security Hub. * Uses API: POST /findingsv2. * Supports delta synchronization using 'finding_info.modified_time_dt' * Creates tests and test results in Configuration Compliance. {#aws-sem-integrations__ul_kqc_xv4_53c} | Third, Daily |
[Table 2. Supported integration details]

{#aws-sem-integrations__table_rvc_y54_53c}

## AWS Inspector REST messages {#aws-sem-integrations__section_wfw_tcp_53c}

{#aws-sem-integrations__table_inspector_rest__entry__4}

| Name | Endpoint | HTTP method | Description |
|-|-|-|-|
| List Findings | `https://inspector2.${region}.amazonaws.com/findings/list` | POST | Retrieves findings from AWS Inspector. Uses `nextToken` and `maxResults` for pagination. |
| STS AssumeRole | `https://sts.${region}.amazonaws.com/` | POST | Retrieves temporary security credentials via AWS STS AssumeRole. |
[ ]

{#aws-sem-integrations__table_inspector_rest}

## AWS Security Hub REST messages {#aws-sem-integrations__section_jcv_xcp_53c}

{#aws-sem-integrations__table_security_hub_rest__entry__4}

| Name | Endpoint | HTTP method | Description |
|-|-|-|-|
| Get Findings | `https://securityhub.${region}.amazonaws.com/findingsv2` | POST | Retrieves findings from AWS Security Hub. Uses `NextToken` (PascalCase) for pagination. |
| STS AssumeRole | `https://sts.${region}.amazonaws.com/` | POST | Shared with Inspector. Retrieves temporary security credentials. |
[ ]

{#aws-sem-integrations__table_security_hub_rest}  
Note:  
The nextToken field uses PascalCase (NextToken) in Security Hub responses, unlike Inspector which uses camelCase (nextToken). The integration handles this difference automatically.