---
title: "Aqua Workload Protection"
slug: "aqua-workload-protection"
updated: 2025-03-25T14:38:36Z
published: 2025-03-25T14:38:36Z
canonical: "docs.databee.buzz/aqua-workload-protection"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Aqua Workload Protection

Aqua Workload Protection provides services which secure containers, Kubernetes, serverless functions, and VMs against evolving cloud native threats with runtime security, powered by real-world threat intelligence. More information can be found at the [Aqua Security website](https://docs.aquasec.com/saas/workload-protection/).

**Integration Method:** API

**Tables:** Detection Finding (2004), Vulnerability Finding (2002), Scan Activity (6007), Web Resources Activity (6001)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Incidents | Retrieve incidents based on filter criteria |
| Hosts | Retrieves scan history of all hosts |
| Vulnerabilities | Lists all vulnerabilities found in images |
| Workloads | Lists data of unique workloads |
| Containers | Get list of containers with associated security information |

This integration supports the following versions.

| Aqua Workload Protection API Version | v2 |
| --- | --- |

> [!NOTE]
> **Note**:
> 
> Aqua Security doesn’t follow a traditional versioning system. Instead, it is a continuously updated SaaS platform. As for this document preparation, the latest release was in [January 2025](https://docs.aquasec.com/saas/release-information/).

## Prerequisites

- The user should have access to the DataBee console.
- The user should make sure to have below configurations, to use the REST APIs:
  - An Aqua user having Administrator privileges.
  - Aqua requirements for role(s), permission set(s), and application scope(s).
  - A CSPM API key and secret.

## Configuration Overview

1. Generate an API Key from the Aqua Security dashboard.
2. Add the [Aqua Workload Protection data feed](/user-manual/docs/aqua-workload-protection#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **Aqua Workload Protection Parameter** |
| --- | --- |
| API Base URL <instance> | [Instance ID](/docs/aqua-workload-protection#InstanceID) |
| Token URL | [Token URL endpoint](/docs/aqua-workload-protection#TokenURL) |
| Integration Key | [API Key](/docs/aqua-workload-protection#APIKey) |
| Secret Key | [Secret](/docs/aqua-workload-protection#Secret) |

## Aqua Workload Protection Configuration

Login to the [Aqua Security](https://cloud.aquasec.com/signin?logout=true) dashboard to configure a role.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-m16qezjl.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)

### Configure Role

This role must be configured as follows:

1. Application Scopes: Ensure Global Application scope
  1. Navigate to **Account Management** from the menu.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-v7955clo.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  2. Navigate to **User Management** > **Application Scopes**. Verify that **Global** Application Scope is listed there. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-f2a9r842.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)

> [!NOTE]
> **Note**:
> 
> Global application scope should be there, by default. Refer to [Application Scopes](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-application-scopes/) for more information on creating and configuring application scopes.
2. Permission Sets: Ensure that a permission set is created with only view permissions applied to the Workload Protection module.
  1. Navigate to **Permission Sets** and click on **Add Permission Set**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-s5ejnr1e.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  2. In the **“**Add Permission Set” window, make sure to follow the steps:

> [!NOTE]
> **Note**:
> 
> Refer to [Permission Sets](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-permission-sets/) for more information on creating and configuring permission sets.
    1. Enter ‘Name’ and relevant ‘Description’ for the Permission Set.
    2. From the **Permissions** section, click on **WORKLOAD PROTECTION** module.
      - Make sure that Workload Protection **Module is Enabled**.
      - For the permissions, ‘Set all as’ **View** from the dropdown.
      - Click **Save**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-pwbbq0rt.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
3. Roles: Ensure that a role is created with the default Global Application scope and the Permission Set created in the earlier step.
  1. Navigate to **Roles** and click on **Add Role**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-7h9owg2u.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  2. In the “New Role” window, fill in required information:
    - Name: enter name for a new role.
    - Description: enter description for a new role.
    - Permission Set: select above created Permission Set.
    - Application Scope(s): select Global Application Scope.
  3. Click **Save.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-3u8s8m3t.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)

> **Note**:
> 
> Refer to [Roles](https://docs.aquasec.com/saas/account-management/rbac-role-based-access-control/am-roles/#add-a-role) for more information on adding, modifying or deleting a role.

### Generate API key and secret

1. Login to your Aqua Security dashboard, as mentioned earlier.
2. In Aqua Security UI, navigate to **Account Management**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-wnp5a8cf.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
3. In the “Account Management” page, navigate to **Settings** > **API Keys** and click on **Generate Key**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-uzuln7my.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
4. In the “New API Key” window, create an API Key by entering the necessary ‘Description’. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-ubj4reag.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
5. Copy and save the **API Key** and **Secret** values before closing the pop-up window. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-cmugkt7l.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)

> [!NOTE]
> **Note**:
> 
> Copy and Save the API Key details. The Client Secret will not be shown again.
6. In the “API Keys” window, edit the newly generated API key.
  1. Click on **Edit** API Key. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-hz2fiew8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  2. In the ‘Global Permissions’ section, disable the **Enable global admin permission** option.
  3. In the ‘Granular Permissions’ section, enable the **tokens:readwrite** and **roles:assign** permissions. While enabling tokens:readwrite, select the role that was created earlier.
  4. Click **Save**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-y7mpe1ty.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
7. Navigate to **WORKLOAD PROTECTION** > **Settings** > **Console URL** from menu and copy **Instance ID** from URL extraction. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-ozcin8b9.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
8. For the Instance ID confirmation, raise support assistance from Aqua Support for your tenant.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-j0pffo43.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
2. Search for the **Aqua Workload Protection** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-03j6nngr.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-ouls8nup.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-lgcbot3a.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
5. In the configuration page, confirm the following:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-uw6yv7k8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  - Authorization Method: HMAC Auth
  - API Base URL: this is the base URL that DataBee will interact with. Replace <instance> in the API URL(s) with the [instance id](/docs/aqua-workload-protection#InstanceID) copied earlier.
  - Integration Key: paste the previously generated [API key](/docs/aqua-workload-protection#APIKey).
  - Secret Key: paste the previously generated [Secret](/docs/aqua-workload-protection#Secret).
  - Token URL: enter the Token URL endpoint based on your geographical region and append it with *v2/tokens* path. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aqua-workload-protection-mar2025-image-s8mmwrv1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A02%3A55Z&se=2026-10-30T13%3A02%3A55Z&sr=c&sp=r&sig=6DpPniiJsfOjQhsF9pEGzvhpXprBuBRnERHXCL8sJII%3D)
  - **Event Types**: preselected for all the event types that integration pulls.
6. Click **Submit**.

## Troubleshooting Tips

- Ensure that secrets are pasted correctly. Since you cannot view the API secrets after the 1st time, re-create the API Key, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- Ensure the Aqua Workload Protection scopes/permissions are correct.