Skip to main content

Amazon App Runner

Amazon App Runner by Amazon Web Services (AWS) is a fully managed container-application platform that lets you build, deploy, and run containerized web applications and API services without managing infrastructure. You can bring service inventory data from Amazon App Runner into Brinqa to gain a unified view of your attack surface, thus strengthening your cybersecurity posture. The connector captures service configuration, public-facing URLs, CPU/memory sizing, instance roles, and a derived IS_PUBLICLY_ACCESSIBLE flag for quick identification of internet-reachable workloads.

This document details the information you must provide for the connector to authenticate with Amazon App Runner and how to obtain that information from Amazon. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings​

When setting up a data integration, select Amazon App Runner from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Amazon App Runner with Brinqa:

  • Access key ID and Secret access key: The access keys associated with the AWS account. The account must have the required read-only permissions for App Runner. For additional information, see Create an IAM user for AWS access.

  • Default region: The AWS region for the connector. If not specified, the connector uses the AWS Default Region Provider Chain to automatically determine the most appropriate region. For additional information on the AWS Default Region Provider Chain, refer to the AWS documentation.

Create an IAM user for AWS access​

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

The IAM user or role must have the following permissions:

apprunner:ListServices
apprunner:DescribeService
apprunner:ListTagsForResource

Additional settings​

The Amazon App Runner connector contains additional options for specific configuration:

  • Assume role ARN: ARN of an IAM role to assume. Comma-separated to assume multiple roles in the same sync.
  • Session duration: Assume-role session duration in seconds. The default setting is 3600.
  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.
  • Parallel requests: The maximum number of parallel API requests. The default setting is 8.
  • Maximum retries: The maximum number of times that the integration attempts to connect to the Amazon App Runner API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve​

The Amazon App Runner connector can retrieve the following types of data from the Amazon App Runner API:

Table 1: Data retrieved from Amazon App Runner

Connector ObjectRequiredMaps to Data Model
AppRunnerServiceYesServerless
info

For detailed steps on how to view the data retrieved from Amazon App Runner in the Brinqa Platform, see How to view your data.

Attribute mappings​

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

AppRunnerService

Table 2: AppRunnerService attribute mappings

Source Field NameSDM Attribute
Constant AWSCLOUD_PROVIDER
Service.instanceConfiguration.cpuCPU
Service.createdAtFIRST_SEEN
Service.instanceConfiguration.instanceRoleArnINSTANCE_ROLE_ARN
Service.networkConfiguration.ingressConfiguration.isPubliclyAccessibleIS_PUBLICLY_ACCESSIBLE
Sync timestampLAST_CAPTURED
Service.instanceConfiguration.memoryMEMORY
Service.serviceName (falls back to ARN)NAME
Sync regionREGION
Service.serviceArnSERVICE_ARN
Service.serviceIdSERVICE_ID
Service.serviceNameSERVICE_NAME
Service.updatedAtSOURCE_LAST_MODIFIED
Service.statusAsString()SOURCE_STATUS
ListTagsForResourceResponse.tags (rendered as key:value)TAGS
Service.serviceArnUID
Service.serviceUrlURL

Operation options​

info

The Amazon App Runner connector does not support operation options at this time.

APIs​

The Amazon App Runner connector uses the AWS App Runner API. Specifically, it uses the following endpoints:

Table 3: Amazon App Runner API endpoints

Connector ObjectAPI Endpoint
AppRunnerServiceapprunner:ListServices
apprunner:DescribeService
apprunner:ListTagsForResource

Changelog​

The Amazon App Runner connector has undergone the following changes:

note

This connector is part of a bundled release with other connectors from the same vendor. If a version shows "No change", it means that the connector version was updated for consistency as part of the bundle, but no functional changes were made to this specific connector. You can update to or skip this version without affecting your existing configuration.

Table 4: Amazon App Runner connector changelog

VersionDescriptionDate Published
3.1.0Initial Integration+ release.June 1st, 2026
Last updated on