SQS Queue

Integrate with SQS to send Tenable One AI Exposure findings to your SQS queue.

What to do next:

• To start sending data for findings, you need to also configure automation rules or manually trigger an action after you add the integration. Successfully completing all integration steps doesn't trigger the sending of any data on its own.

Add an SQS Queue

To add an SQS queue:

1. In the AI Exposure Console, navigate to Settings > Integrations.
2. (Options) Select a scope in the Organization dropdown.
3. Click Add Integration.
4. In the Integrations Library, click SQS. The SQS wizard opens.
5. Enter a Name for the integration to be displayed in AI Exposure.
6. Enter the URL of the queue. The URL is available in the AWS Console, in the Details section of the queue. Valid format - https://sqs.{region}.amazonaws.com/{account id}/{queue name}
7. Grant Tenable permissions. Tenable uses an IAM role to push messages to your SQS queue. Use the same role used to onboard your AWS environment to Tenable (default), or create a custom role (for example, if your queue is in an account that hasn't been onboarded).
   • Use default IAM role:
     1. In the AWS Management Console, navigate to IAM > Roles.
     2. Search for and click on the role you created for AI Exposure when you onboarded your AWS environment.
     3. To edit the policy, under Permissions > Permissions policies, click on the monitoring (read-only) policy name that you created during onboarding.

     4. In the JSON editor, add the following permission:

        "SQS:SendMessage"

     5. Click Next.
     6. Review the changes and then click Save changes.

     7. (If your queue is encrypted with KMS):

        1. In the AWS Management Console, navigate to KMS > Customer managed keys.
        2. Click on the relevant key, and in the Key policy section click Edit.
        3. In the JSON editor, add the following additional statement to the policy and then click Save changes:
        Copy

        JSON

         {
            "Sid": "Allow Read Access to Key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "<IAM Role ARN>"
            },
            "Action": [
             "kms:GenerateDataKey",
             "kms:Decrypt"
            ],
            "Resource": "*"
        }

   • Use custom IAM role:
     1. In the AWS Management Console, navigate to IAM > Roles and click Create role.
     2. For the trusted entity type, select AWS account.

     3. For the AWS account, select Another AWS account and then enter one of the following numbers as the Account ID, depending on your AWS environment type:

        • Public Cloud: 081802104111
        • US Gov Cloud: 757023926892
        Note: This is Tenable’s account ID. The ID must be exactly twelve-digits; make sure not to include any extra spaces.
     4. Under Options, check Require external ID.

     5. Enter the Role External ID provided in the Add SQS Queue wizard (Tenable Console).

        Note: The Role External ID is a unique identifier that AI Exposure assigns to your customer account. This ID will be the same for each account you create for your organization. For more information, refer to AWS IAM documentation.
     6. Click Next.
     7. On the Add permissions page, click Next.
     8. Enter a meaningful Role name and Description and then click Create role.
     9. Open the newly created role and under Permissions, click Add permissions > Create inline policy.

     10. Copy the following policy, and paste it into the JSON tab to replace the existing text, where {SQS_ARN} is the ARN of your SQS queue.

         Note: Replace {SQS_ARN} in the snippet below with the ARN of your SQS queue. The ARN is available in the AWS Console, in the Details section of the queue.
         Copy

         JSON

         {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "sqs:SendMessage"
                  ],
                  "Resource": "{SQS_ARN}"
              }
          ]
         } 

     11. Click Next.
     12. Enter a meaningful Policy name and then click Create policy.
     13. Copy the ARN of the custom role that you created.
     14. (AI Exposure Console) Paste the IAM role ARN and then click Finish
     15. (If your queue is encrypted with KMS)
         1. In the AWS Management Console, navigate to KMS > Customer managed keys.
         2. Click on the relevant key, and in the Key policy section click Edit.

         3. In the JSON editor, add the following additional statement to the policy and then click Save changes:

            Copy

            JSON

             {
                "Sid": "Allow Read Access to Key",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "<IAM Role ARN>"
                },
                "Action": [
                 "kms:GenerateDataKey",
                 "kms:Decrypt"
                ],
                "Resource": "*"
            }

Sample JSON

{
  "source": "Tenable",
  "action": "Create JIT eligibility",
  "details": {},
  "result": "Success",
  "scope": "Organization\\Azure AD",
  "time": "2024-06-25T10:21:23.7023655Z",
  "approvalRequired": true,
  "approvers": [
    "006"
  ],
  "requesters": [
    "003"
  ],
  "maxDurationHours": 21,
  "name": "More eligibilities for testing",
  "user": "***@customer1.onmicrosoft.com",
  "ticketLinks": [
    "https://tenablecustomer1.atlassian.net/browse/DAV-24140",
    "https://tenablecustomer1.atlassian.net/browse/DAV-24144",
    "https://tenablecustomer1.atlassian.net/browse/DAV-24148",
    "https://tenablecustomer1.atlassian.net/browse/DAV-24152"
  ],
  "comments": [
    {
      "message": "created a ServiceNow incident for this threat story",
      "time": "2026-07-29T09:00:13.124307Z",
      "userName": "Tenable"
    },
    {
      "message": "created a Jira ticket for this threat story",
      "time": "2026-07-29T09:00:05.609867Z",
      "userName": "Tenable"
    }
  ]
}