---
title: AWS Integration for Security Exposure Management integrations
description: Integrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/aws-sem-integrations.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-04-02"
reading_time_minutes: 2
breadcrumb: [AWS Integration for Security Exposure Management, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# AWS Integration for Security Exposure Management integrations

Integrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.

## Required roles

Users who configure and use the integration must be assigned the appropriate ServiceNow roles.

-   **__sn\_vul\_aws.configure\_integration__**

    Allows you to configure authentication credentials for the AWS plugin.

-   **__sn\_vul\_aws.read\_integration__**

    Provides read access to AWS integrations and AWS tables.


## Dependencies

AWS Integration for Security Exposure Management requires the following ServiceNow® applications:

-   **Vulnerability Response** \(required\) — Core application for vulnerability management.
-   **Container Vulnerability Response** \(optional\) — Required for the AWS Inspector Container and AWS Security Hub Container integrations.
-   **Configuration Compliance** \(optional\) — Required for the AWS Security Hub Test Results integration.

## AWS Inspector Integrations

<table id="table_kxb_jw4_53c"><thead><tr><th>

Integration

</th><th>

Description

</th><th>

Run sequence and frequency

</th></tr></thead><tbody><tr><td>

AWS Inspector Host Vulnerability Integration

</td><td>

-   Retrieves all host vulnerability findings from AWS Inspector for EC2 Instances and Lambda Functions.
-   Uses API: POST /findings/list.
-   Supports delta synchronization using 'updatedAt' filter
-   Uses 'nextToken' and 'maxResults' for pagination.
-   Creates vulnerable items \(VIT\)s, discovered items, and Detections.

</td><td>

First, Daily.

</td></tr><tr><td>

AWS Inspector Container Vulnerability Integration

</td><td>

-   Retrieves all container vulnerability findings from AWS Inspector for ECR Container Images.
-   Uses API: POST /findings/list.
-   Supports delta synchronization using 'updatedAt' filter
-   Uses 'nextToken' and 'maxResults' for pagination.
-   Creates container vulnerable items \(CVIT\)s, discovered container images, and Findings.

</td><td>

Second, Daily.

</td></tr></tbody>
</table>## AWS Security Hub Integrations

<table id="table_rvc_y54_53c"><thead><tr><th>

Integration

</th><th>

Description

</th><th>

Run sequence and frequency

</th></tr></thead><tbody><tr><td>

AWS Security Hub Host Vulnerability Integration

</td><td>

-   Retrieves host vulnerability findings \(EC2 Instances, Lambda Functions\) from AWS Security Hub.
-   Uses API: POST /findingsv2.
-   Supports delta synchronization using 'finding\_info.modified\_time\_dt'.
-   Uses 'maxResults' and 'nextToken' for pagination.
-   Creates vulnerable items \(VIT\)s, discovered items, and detections.

</td><td>

First, Daily.

</td></tr><tr><td>

AWS Security Hub Container Vulnerability Integration

</td><td>

-   Retrieves container vulnerability findings \(ECR Container Images\) from AWS Security Hub.
-   Uses API: POST /findingsv2.
-   Supports delta synchronization using 'finding\_info.modified\_time\_dt'
-   Creates container vulnerable items \(CVIT\)s, discovered container images, and Findings.

</td><td>

Second, Daily.

</td></tr><tr><td>

AWS Security Hub Test Results Integration

</td><td>

-   Retrieves misconfigurations of various assets types from AWS Security Hub.
-   Uses API: POST /findingsv2.
-   Supports delta synchronization using 'finding\_info.modified\_time\_dt'
-   Creates tests and test results in Configuration Compliance.

</td><td>

Third, Daily

</td></tr></tbody>
</table>## AWS Inspector REST messages

|Name|Endpoint|HTTP method|Description|
|----|--------|-----------|-----------|
|List Findings|`https://inspector2.${region}.amazonaws.com/findings/list`|POST|Retrieves findings from AWS Inspector. Uses `nextToken` and `maxResults` for pagination.|
|STS AssumeRole|`https://sts.${region}.amazonaws.com/`|POST|Retrieves temporary security credentials via AWS STS AssumeRole.|

## AWS Security Hub REST messages

|Name|Endpoint|HTTP method|Description|
|----|--------|-----------|-----------|
|Get Findings|`https://securityhub.${region}.amazonaws.com/findingsv2`|POST|Retrieves findings from AWS Security Hub. Uses `NextToken` \(PascalCase\) for pagination.|
|STS AssumeRole|`https://sts.${region}.amazonaws.com/`|POST|Shared with Inspector. Retrieves temporary security credentials.|

**Note:**

The nextToken field uses PascalCase \(NextToken\) in Security Hub responses, unlike Inspector which uses camelCase \(nextToken\). The integration handles this difference automatically.