--- title: "Aqua CSPM" slug: "aqua-cspm" updated: 2025-03-20T20:01:07Z published: 2025-03-20T20:01:07Z canonical: "docs.databee.buzz/aqua-cspm" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Aqua CSPM Aqua CSPM detects misconfigurations, compliance violations, and vulnerabilities across multi cloud environments. More information can be found on the [Introduction to CSPM](https://docs.aquasec.com/saas/cspm/). **Integration Method:** API **Tables:** Compliance Finding (2003), Scan Activity (6007), Detection Finding (2004) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Scans | List all scan results. | | Compliances | List all compliances. | This integration supports the following versions. | Aqua CSPM API version | v2 | | --- | --- | > [!NOTE] > **Note**: > > Aqua Security is a continuously updated SaaS platform. As for this document preparation, the latest release was in [January 2025](https://docs.aquasec.com/saas/release-information/). ## Prerequisites - The user should have access to the DataBee console. - The user should make sure to have below configurations, to use the REST APIs: - An Aqua user having Administrator privileges. - Aqua requirements for role(s), permission set(s), and application scope(s). - A CSPM API key and secret. ## Configuration Overview 1. Generate an API Key from the Aqua Security dashboard. 2. Add the [Aqua CSPM data feed](/user-manual/docs/aqua-cspm#databee-configuration) in the DataBee console with the below parameters. | **DataBee Parameter** | **Aqua CSPM Parameter** | | --- | --- | | Integration Key | [API Key](/docs/aqua-cspm#APIKey) | | Secret Key | [Secret](/docs/aqua-cspm#Secret) | ## Aqua CSPM Configuration ### Configure Role This role must be configured as follows: 1. Application Scopes: make sure that Global Application Scope is created. Refer to [Application Scopes](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-application-scopes/) for more information on creating and configuring application scopes. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-jgrlsn88.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 2. Permission Sets: ensure that a permission set is created with only view permissions applied to the CSPM module. Refer to [Permission Sets](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-permission-sets/) for more information on creating and configuring permission sets. 3. Click on **Add Permission Set.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-bdukxth2.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 4. In the **“**Add Permission Set” window, make sure to follow the steps: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-a6wk49w0.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 1. Enter ‘Name**’** and relevant ‘Description’ for the Permission Set. 2. From the Permissions section, click on **CSPM** module. - Make sure that CSPM Module is Enabled. - For the permissions, ‘Set all as’ **View** only from the dropdown. - Click **Save.** 5. Role: ensure that a role is created with the default Global Application scope and the Permission Set created in the 1st step. Refer to [Roles](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-roles/#add-a-role) for more information on adding a role. 1. Click on **Add Role.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-dhdn0o7t.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 2. In the ‘New Role’ window, fill in required information: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-4lqj0jyo.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) - Name: enter Name for a new role. - Description: enter Description for a new role. - Permission Set: select above created Permission Set. - Application Scope(s): select Global Application Scope. - Click **Save.** ### Generate a CSPM API key and secret 1. Login to your Aqua Security dashboard. 2. In Aqua Security UI, navigate to **Account Management**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-ifp247qt.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 3. In the Account Management page, navigate to **Settings** > **API Keys** and Click on **Generate Key**. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-1fh6opjj.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 4. In the **New API Key** window, create an API Key by entering the necessary **Description**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-es91raso.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 5. Copy and save the **API Key** and **Secret** values before closing the pop-up window. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-lyfvn7ex.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) > [!NOTE] > Note: > > Copy and Save the API Key details. The Client Secret will not be shown again. 6. In the “API Keys” screen, edit the newly generated API key. 1. Click on **Edit** API Key. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-30fvgc4p.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 2. In the **Global Permissions** section, disable the **Enable global admin permission** option. 3. In the **Granular Permissions** section, enable the **tokens:readwrite** and **roles:assign** permissions. While enabling **tokens:readwrite,** select the role that was created as a part for our user creation process. 4. Additionally, enable below permissions to fetch required events: 1. compliances:read 2. scansv2:read 7. Click **Save**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-mq5i2xmh.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-cpxjonxr.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 2. Search for the **Aqua CSPM** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-k6lrajrc.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-qzoulftb.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 4. Enter feed contact information and click **Next.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-09nn9kcw.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 5. In the configuration page, confirm the following: - Authorization Method: HMAC Auth - API Base URL: this is the base URL that DataBee will interact with. - Integration Key: paste the previously generated [API key](/docs/aqua-cspm#APIKey). - Secret Key: paste the previously generated [Secret](/docs/aqua-cspm#Secret). - Event Types: preselected for all the event types that integration pulls. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-cspm-mar2025-image-g5johp00.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A55%3A55Z&se=2026-10-30T12%3A55%3A55Z&sr=c&sp=r&sig=3VIS8wQLebsjozS2BS%2Bb39zcXAIPora9lRoy%2FXB7l5I%3D) 6. Click **Submit.** ## Troubleshooting Tips - Ensure that secrets are pasted correctly. Since you cannot view the API secrets after the 1st time, re-create the API Key, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed. - Ensure the Aqua CSPM scopes/permissions are correct. #