AWS Inspector

AWS Inspector

Beta
Beta release

This source is currently in beta. It works end to end, but you may still hit rough edges. Let us know if you do.

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

Learn more
PostHog Wizard hedgehog

Connect AWS Inspector to PostHog to sync your data into the PostHog data warehouse for analysis and modeling.

Sync Amazon Inspector findings, scan coverage, and CIS scans into the PostHog Data warehouse.

Enable Amazon Inspector in the region you select. Grant these IAM permissions for the tables you select:

  • findings: inspector2:ListFindings
  • coverage: inspector2:ListCoverage
  • coverage_statistics: inspector2:ListCoverageStatistics
  • members: inspector2:ListMembers (delegated administrator account only)
  • cis_scans: inspector2:ListCisScans
  • cis_scan_result_details: inspector2:ListCisScans, inspector2:ListCisScanResultsAggregatedByTargetResource, and inspector2:GetCisScanResultDetails
  • clusters_for_image: inspector2:ListCoverage and inspector2:GetClustersForImage

Enter your access key ID and secret access key. Add a session token if you use temporary credentials. This source reads one AWS region.

Configuration

OptionDescription
AWS access key ID
Type: text
Required: True
AWS secret access key
Type: password
Required: True
AWS session token
Type: password
Required: False

Temporary credentials expire. Connect again with new credentials when the session token expires.

AWS region
Type: text
Required: True

Linking AWS Inspector to PostHog

  1. Go to the Data pipeline page in PostHog
  2. Click New source and select AWS Inspector
  3. Fill in the required configuration fields
  4. Click Next, select the tables you want to sync, and then press Import

Supported tables

TableDescriptionSync methodIncremental fieldPrimary key
findings

Vulnerability and network reachability findings for resources in the selected AWS region.

Incremental, Full refreshupdated_at—
coverage

Resources and scan types monitored by Amazon Inspector in the selected AWS region.

Full refresh——
coverage_statistics

Resource counts grouped by resource type in the selected AWS region.

Full refresh——
members

Member accounts of the Amazon Inspector delegated administrator, with their relationship status.

Full refresh——
cis_scans

CIS benchmark scans with their status and passed and failed check counts.

Full refresh——
cis_scan_result_details

Outcome of each CIS benchmark check for each scanned resource.

Incremental, Full refreshscan_date—
clusters_for_image

Amazon ECS and Amazon EKS clusters that run each Amazon ECR image Inspector covers.

Full refresh——