Aqua Security: Container and Cloud-Native Security Testing Guide

Container security is different from traditional application security. Your attack surface includes the base image, installed packages, runtime configuration, Kubernetes RBAC, network policies, and more — not just your application code.

Aqua Security is purpose-built for this environment. This guide covers what Aqua does, how to integrate it into your pipeline, and how security and DevOps teams use it effectively.

What Aqua Security Covers

Aqua is a cloud-native application protection platform (CNAPP) with several overlapping capabilities:

Image Scanning (SAST for containers):

• OS package vulnerabilities (CVEs from NVD, OS vendor feeds)
• Application dependency vulnerabilities (npm, pip, Maven, Gem, etc.)
• Embedded secrets and hardcoded credentials
• Malware detection
• Dockerfile misconfigurations

Runtime Security:

• Behavioral profiling — learn what a container does normally, alert on deviations
• Drift prevention — block new executables that weren't in the original image
• Network policy enforcement
• File system monitoring

Kubernetes Security Posture Management (KSPM):

• Misconfigured RBAC
• Exposed API servers
• Missing Pod Security Admission settings
• Compliance checks (CIS Kubernetes Benchmark)

Infrastructure as Code (IaC) Scanning:

• Terraform, CloudFormation, Helm, Kubernetes manifests
• Flags misconfigurations before deployment

Image Scanning Setup

Aqua CLI Scanner

# Install
curl -o aquasec-scanner https://download.aqua.sec/scanner/aquasec-scanner-linux
chmod +x aquasec-scanner

# Scan a local image
./aquasec-scanner scan \
  --host https://your-aqua-instance.aquasec.com \
  --user $AQUA_USER \
  --password $AQUA_PASSWORD \
  --local my-app:latest

# Scan an image from a registry
./aquasec-scanner scan \
  --host https://your-aqua-instance.aquasec.com \
  --user $AQUA_USER \
  --password $AQUA_PASSWORD \
  registry.yourcompany.com/my-app:1.2.3

Docker Hub / Registry Integration

Aqua can auto-scan images when they're pushed to a registry:

1. In Aqua Console: Image Scanning > Registries > Add Registry
2. Connect your Docker Hub, ECR, GCR, or ACR account
3. Configure scan triggers: on push, on schedule, or on-demand
4. Set policies: block images with critical CVEs, require scan before deployment

CI/CD Integration

GitHub Actions

name: Aqua Security Scan
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Build Docker image
        run: docker build -t my-app:${{ github.sha }} .
      
      - name: Aqua Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
      
      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

Note: Aqua's open-source scanner Trivy is widely used in pipelines; the commercial Aqua platform adds policy enforcement, runtime protection, and centralized management.

GitLab CI

aqua-scan:
  stage: test
  image: aquasec/aqua-scanner:latest
  script:
    - aquasec scan 
        --host $AQUA_URL
        --user $AQUA_USER
        --password $AQUA_PASSWORD
        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  allow_failure: false
  only:
    - main
    - merge_requests

Kubernetes Admission Controller

Aqua's Kubernetes enforcer (MicroEnforcer) runs as a webhook and blocks non-compliant pods at deployment time:

# Aqua enforcer namespace
apiVersion: v1
kind: Namespace
metadata:
  name: aqua
---
# The enforcer DaemonSet connects to your Aqua server
# and enforces image assurance policies cluster-wide

With the enforcer installed, any kubectl apply or Helm deploy that references an unscanned or non-compliant image gets rejected before the pod starts.

Understanding Scan Results

Vulnerability Breakdown

Each scan produces:

• CVE list — each vulnerability with CVSS score, affected package, fix version
• Severity breakdown — Critical / High / Medium / Low / Negligible counts
• Fix availability — what percentage of findings have an available fix

Assurance Policies

Aqua uses policies to decide pass/fail:

{
  "policy": "my-app-policy",
  "rules": [
    {
      "type": "max_severity",
      "value": "high",
      "action": "fail"
    },
    {
      "type": "cvss_v3_score",
      "value": 9.0,
      "action": "fail"
    },
    {
      "type": "sensitive_data",
      "action": "fail"
    }
  ]
}

Common policy rules:

• Block images with CVSS score ≥ 7.0
• Block images with embedded secrets
• Block images using latest tag
• Require specific base image (e.g., must be based on debian:12-slim)
• Block images not scanned in the last 30 days

Dockerfile Best Practices Flags

Aqua's IaC scanner checks Dockerfile configuration:

Runtime Protection

After deployment, Aqua's enforcer monitors running containers:

Behavioral profiling: During an initial learning period, Aqua observes what processes, network connections, and file system paths a container uses normally. After learning, deviations trigger alerts or blocks.

Drift prevention: Any file added to a running container that wasn't in the original image is blocked. This prevents "living off the land" attacks where attackers add tools post-compromise.

Network microsegmentation: Define which containers can communicate with which. Block unexpected outbound connections.

Runtime events appear in Aqua Console under Runtime > Incidents.

Kubernetes Posture Management

Aqua's KSPM module continuously scans your cluster configuration:

# Run a cluster assessment
aquasec assess --target kubernetes \
  --kubeconfig ~/.kube/config \
  --benchmark cis-kubernetes

Common findings:

• Anonymous authentication enabled on API server
• No network policies defined for sensitive namespaces
• RBAC with wildcard permissions (* / *)
• Secrets not encrypted at rest
• No Pod Security Admission controller

Integrations

Aqua integrates with:

• Jira / ServiceNow — auto-create tickets for critical findings
• Slack / PagerDuty — runtime incident alerts
• Splunk / Datadog — forward events to SIEM
• GitHub / GitLab — inline PR comments on scan results
• ArgoCD / Flux — block GitOps deploys of non-compliant images

Metrics to Track

Aqua vs. Trivy (Open Source)

Trivy is Aqua's open-source scanner — excellent for CI pipeline checks (CVE detection, secret scanning, IaC misconfiguration). The commercial Aqua platform adds:

• Centralized policy management across teams
• Runtime protection and drift prevention
• Kubernetes posture management
• Risk-based prioritization (exploitability scoring, reachability)
• Compliance reporting (SOC2, PCI-DSS, HIPAA)

For small teams, start with Trivy. For enterprise deployments where you need runtime protection and centralized governance, the full Aqua platform is worth it.

Common Mistakes

Scanning only in CI but not at deploy time. An image scanned and passed on Monday may have new CVEs by Friday. Either re-scan on deploy or set a maximum scan age policy.

Treating all CVEs as equal urgency. A CVSS 9.8 CVE in a library your app never actually calls is lower priority than a CVSS 7.0 CVE in your authentication library. Use Aqua's reachability analysis to prioritize.

Skipping runtime. SAST on images catches known vulnerabilities. It doesn't catch an attacker who exploits an unknown vulnerability post-deploy. Runtime protection is the second line of defense.

Using latest tags. Policies can enforce image pinning. latest breaks reproducibility and makes it hard to know which version is actually running.

Summary

Aqua Security gives you full-lifecycle container security: scan before you ship, enforce at deploy, protect at runtime. Start with image scanning in CI, add registry integration, then layer on the Kubernetes enforcer as your posture matures.

For teams that need to demonstrate security compliance in cloud-native environments, Aqua's compliance reports (CIS Benchmarks, NIST, PCI-DSS) reduce audit prep time significantly.