AWS touches Safeguard in four documented places. The docs are light on AWS step by step detail, so this guide maps the options and tells you where the docs stop.
What it is
- Container images: Amazon ECR is listed among the container registries you can scan from Integrations.
- Compliance connector: the connector catalog lists Amazon Web Services and AWS GovCloud with API token connection and automated evidence collection. Related AWS services in the catalog include S3, CloudWatch, Security Hub, Inspector and CodeCommit.
- CLI cloud scan: the Integrations page describes a Cloud Scan that checks cloud configuration posture for AWS, Azure and GCP. It runs from the Safeguard CLI on infrastructure you own, and results upload to the console as projects.
- Event delivery: webhook events can go directly to AWS Kinesis Data Streams or Firehose.
How to use it
For images, open Integrations, filter to Container Image, click Connect on the Amazon ECR card and follow the same workflow as other sources: configure access, review, connect, then see the result in Projects.
For the compliance connector, the catalog says connections use an API token and that each connector has its own setup page. The docs say automated compliance tests are switched on per workspace by the Safeguard team. I could not reach an AWS setup page, so I will not state IAM permissions. Ask your Safeguard admin for the setup reference and give the connection read access only.
For events, create a subscription on the Webhooks page with an endpoint, event types and a signing secret. Delivery is at least once, so deduplicate by event ID.
Quick check
Where does the Cloud Scan run?
From the Safeguard CLI, on infrastructure you own. Results upload to the console as projects.
