From 0b68af7c4646e48370175e4d1a0e9352edf8f743 Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Wed, 16 Sep 2026 17:32:13 -0600 Subject: [PATCH] docs(connectors): spell out Aqua Supply Chain's two hosts and the 405 Add the full regional CSPM Auth Host table (US/EU/Singapore/Sydney), state that the Auth Host is separate from the Location edge host, and add a troubleshooting note that a 405 during validation means the Auth Host is not the CSPM API host. Docs for the matching Pro UI clarification; reported via a customer support ticket. --- .../toolreference/aqua_supply_chain.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/aqua_supply_chain.md b/docs/content/connectors/toolreference/aqua_supply_chain.md index f368953a97d..28f8706fdde 100644 --- a/docs/content/connectors/toolreference/aqua_supply_chain.md +++ b/docs/content/connectors/toolreference/aqua_supply_chain.md @@ -15,7 +15,16 @@ An **admin-generated** Aqua **API key and secret**, created under **Account Mana 1. Enter your Aqua Supply Chain **edge** host in the **Location** field, for example `https://eu-central-1.edge.cloud.aquasec.com`. This is not the tenant URL the Aqua Security connector uses. Aqua Supply Chain Security answers on the region's **edge** host, not `.cloud.aquasec.com`. 2. Enter the API key in the **API Key** field. 3. Enter the API secret in the **API Secret** field. -4. If your tenant is in the EU, set the **Auth Host** field to `https://eu-1.api.cloudsploit.com`. Leave it blank for the US host, `https://api.cloudsploit.com`. Aqua caps the issued authentication token at two hours, regardless of the validity the connector requests. The connector re-authenticates on its own when the token expires. +4. Set the **Auth Host** field to your region's Aqua **CSPM API** host. This is a different host from the **Location** edge host above, and it is used only to exchange the API key and secret for a token. Pick the row for your region: + + | Region | Auth Host | + |--------|-----------| + | US | `https://api.cloudsploit.com` (or leave blank) | + | EU | `https://eu-1.api.cloudsploit.com` | + | Singapore | `https://asia-1.api.cloudsploit.com` | + | Sydney | `https://ap-2.api.cloudsploit.com` | + + Do not put the edge host (a `cloud.aquasec.com` address) in **Auth Host**, and do not put the CSPM API host in **Location**. Aqua caps the issued authentication token at two hours, regardless of the validity the connector requests. The connector re-authenticates on its own when the token expires. 5. Optionally, set **Scan Categories** to a comma-separated list of the categories to import. The five values are `vulnerabilities` (SCA), `secrets`, `iacMisconfigurations` (IaC), `sast` and `pipelineMisconfigurations` (Pipeline). Leave it blank to import all five. Each finding carries a `category:` tag naming the category it came from. 6. Optionally, set a **Minimum Severity** to limit which findings are imported. Aqua reports severity as a 0-4 value, which DefectDojo maps to Info, Low, Medium, High and Critical. @@ -67,3 +76,8 @@ Aqua can return several byte-identical rows for the same finding. One example is #### Sync cost A full sync pulls the whole tenant in a handful of requests. It sends roughly one request per 10,000 findings, plus the repository list, which takes two or three requests. The connector groups the results locally. + +#### Troubleshooting + +- **Validation fails with `aqua token exchange failed: unexpected status 405`** (or an "Auth Host redirected" message): the **Auth Host** is not your region's CSPM API host. The token exchange is a `POST` to `/v2/tokens`, and Aqua's gateway answers a `405` when the request lands on a host that redirects it. Set **Auth Host** to the `*.api.cloudsploit.com` host for your region (see the table above) and keep the edge `cloud.aquasec.com` host in **Location**. +- **Validation fails with `401`/`Access denied`**: the API key or secret is wrong, or the key is not admin-generated. Regenerate the key and secret under **Account Management \> API Keys** and re-enter both.