> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/sca360-flexible-deployment-for-data-center-cloud-integrated-environments/configuration.md).

# Configuration

You can use the following advanced configuration options to customize Lineaje SCA360 for your organization’s needs.

* [Configure Upload Automation](#configure-upload-automation)
* [Upload Metadata Files for Upload Automation](#upload-metadata-files-for-upload-automation)

## Configure Upload Automation

To allow the VM to access the metadata file, create an `upload_config.yaml` file. This file holds the configuration for images discovery and integrations.

1. Create a `/opt/veecli/upload_config.yaml` using the specifications in the following upload\_config.yaml file.

```
supported_orgs:
  - "<org_name_1>"
  - "<org_name_2>"
 
images:
  - aws-account-id: "<aws_account_id>"
    org-name: "<org_name>"
    discovery-logic: "<s3-path>"
    repository-url: "<account_id>.dkr.ecr.<region>.amazonaws.com/<repository-name>"
    s3-path: "s3://<bucket-name>/<path-prefix>/"
    role_arn: "arn:aws:iam::<account_id>:role/<role_name>"
    region: "<aws_region>"
 
amis:
  - aws-account-id: "<aws_account_id>"
    org-name: "<org_name>"
    discovery-logic: "s3-path"
    unique-resource-id: "ami-<id>, snap-<id>, i-<instance_id>, arn:aws:ec2:<region>:<account_id>:instance/<instance_id>"
    s3-path: "s3://<bucket-name>/<path-prefix>/"
    role_arn: "arn:aws:iam::<account_id>:role/<role_name>"
    region: "<aws_region>"
```

2. Run the upload\_automation script in the background.
   1. Open a tmux terminal using `tmux new-session -t upload_automation`
   2. Run command to start automation `cd /opt/veecli && python3 upload_automation.py`

      1. For **--wait**, the default value is 24 hours. The script iterates `upload_config.yaml` every 24 hours.
      2. For **--time**, the default value is `00:00`. The script begins waiting from the specified time.

         Example: If `--time 05:30` and `--wait 8` are set, the script performs initial discovery at `05:30`, then repeats every `8` hours, at `13:30` and `21:30`.

      <figure><img src="https://2983949833-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzRZpxg1UUX5iPuJAfelm%2Fuploads%2FMuGehMCgHhKLaK5NGw42%2Fupload-automation.jpg?alt=media&amp;token=7bd7533d-ed2f-4d15-8df2-b6675823d732" alt="upload automation script"><figcaption></figcaption></figure>

## Upload Metadata Files for Upload Automation

Uploading metadata files enables Lineaje SCA360 to discover specific images, associate accurate product details with each image, and maintain privacy by only uploading SBOM metadata tar files to Lineaje infrastructure.

1. Create an image metadata file in YAML format. This file contains key-value pairs describing product information for an Image, AMI, or AWS Lambda function.
2. Store the metadata file in Amazon S3 using the following directory structure:\
   `s3://<bucket-name>/lineaje-data-science/<groupname>/<image-digest/unique-resource-id>.yaml`

   Example: `s3://<lineaje-metafiles-bucket>/lineaje-data-science/data-science/org_name/fb93015b83a2570123456789053ad9ccde3fca76df218b0b91b649f3eadbb8.ya`
3. Name the file using a unique identifier, preferably the SHA256 hash of the image (without the sha256: prefix). The filename is also used for ignore files if SBOM generation is performed for the resource.
4. Include the following mandatory fields in the metadata file:
   * **group:** Organizational hierarchy (e.g., root-org/demo-ush).
   * **project:** Project name to appear in the Lineaje tenant.
   * **version:** Version of the project.
   * **repository-url** (Required for ECR scans): Full ECR repository URI.
   * **image-hash** (Required for ECR scans): SHA256 hash of the image.
   * **unique-resource-id** (Required for AMI/Lambda scans)**:** Unique resource ID.
   * **region** (Required for AMI/Lambda scans): AWS region where the resource is located.
   * **image-creation-date:** Timestamp in ISO 8601 format (e.g., `2025-03-07T13:29:15.000Z`).
   * **sdlc-state:** Software Development Life Cycle state (e.g., `Dev`, `Stage`, `Prod`).
   * **entrypoint:** Optional; can be `null`.
5. Add the following recommended fields for better classification:
   * **description**: Brief description of the image or resource.
   * **tags**: Key-value tags for classification.
   * **owner**: Team or individual responsible for the resource.
6. For ECR images, name the metadata file using `<image_hash>.yaml`

An example file name is `214ae3a3da7c0f0caf17049fdcdeab60585dae60c07d3891f99718a3bb1d8043.yaml`.&#x20;

The following is an example of an ECR metadata content:

```
metadata:
  group: "customer_org"
  project: "project_name_here"
  version: "version_here"
  repository-url: "ecr_repo_url_here"
  image-creation-date: "2025-03-07T13:29:15.000Z"
  image-hash: "image_hash_here"
  sdlc-state: "Prod"
  entrypoint: null
```

7. For source code, name the metadata using `<last_commit_hash>.yaml`***.*** An example file name is `77a9afb0f01bf885231a1a8f5fb25dd0196c0a24.yaml`.&#x20;

The following is an example of a source code metadata content:

```
metadata:
  group: "customer_org"
  project: "project_name_here"
  version: "1.0"
  repository-url: "github_repo_url_here"
  matching-ref: "v1"
  type: "npm"
  sdlc-state: "Prod"
```

## Trigger a Scan Using GitHub Action Workflow

This workflow generates and uploads an image metadata YAML file to S3, triggered manually via `workflow_dispatch` with inputs for the ECR image details, SDLC state, and an optional fix-PR flag. When `create_fix_pr` is enabled, the metadata includes source repository details (repo, branch, Dockerfile path) pulled from repo secrets, enabling Lineaje's automated fix flow post-scan. Configuration values like `AWS_REGION`, `AWS_BUCKET`, and `REPOSITORY_URI` are defined as workflow-level environment variables, but can be moved to repository secrets or organization variables depending on your team's preference. The workflow requires `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` secrets for S3 upload access.

{% code overflow="wrap" %}

```yml
name: Generate and Upload Metadata

on:
  workflow_dispatch:
    inputs:
      image_repo:
        description: "Repository name inside the registry"
        required: true
      image_name:
        description: "Name of the image"
        required: true
      image_tag:
        description: "Tag of the image"
        required: true
      image_hash:
        description: "Image hash (with or without 'sha256:')"
        required: true
      group:
        description: "Lineaje organization group"
        required: false
        default: "Root Organization"
      sdlc_state:
        description: "SDLC state (e.g. Dev, Test, Prod)"
        required: false
        default: "Test"
      create_fix_pr:
        description: "Whether to create a fix PR"
        required: false
        default: "false"

jobs:
  generate-and-upload:
    runs-on: ubuntu-latest

    env:
      AWS_REGION: "us-east-1"
      AWS_BUCKET: "xxx"
      REPOSITORY_URI: "xxx"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Create metadata file
        run: |
          IMAGE_REPO="${{ github.event.inputs.image_repo }}"
          IMAGE_NAME="${{ github.event.inputs.image_name }}"
          IMAGE_TAG="${{ github.event.inputs.image_tag }}"
          IMAGE_HASH="${{ github.event.inputs.image_hash }}"
          GROUP="${{ github.event.inputs.group }}"
          SDLC_STATE="${{ github.event.inputs.sdlc_state }}"
          CREATE_FIX_PR="${{ github.event.inputs.create_fix_pr }}"
          SOURCE_REPO="${{ secrets.SOURCE_REPO }}"
          SOURCE_BRANCH="${{ secrets.SOURCE_BRANCH }}"
          SOURCE_DOCKERFILE="${{ secrets.SOURCE_DOCKERFILE }}"

          CLEAN_HASH=$(echo "$IMAGE_HASH" | sed 's/^sha256://')
          if [[ "$IMAGE_HASH" != sha256:* ]]; then
            FULL_HASH="sha256:${CLEAN_HASH}"
          else
            FULL_HASH="$IMAGE_HASH"
          fi

          FILE_NAME="${CLEAN_HASH}_metadata.yaml"

          if [[ "$CREATE_FIX_PR" == "true" ]]; then
            {
              echo "metadata:"
              echo "  project: \"$IMAGE_NAME\""
              echo "  version: \"$IMAGE_TAG\""
              echo "  repository-url: \"${REPOSITORY_URI}/${IMAGE_REPO}/${IMAGE_NAME}\""
              echo "  region: \"${AWS_REGION}\""
              echo "  image-hash: \"$FULL_HASH\""
              echo "  group: \"$GROUP\""
              echo "  sdlc-state: \"$SDLC_STATE\""
              echo "  create-fix-pr: true"
              echo "  source:"
              echo "    repo: \"$SOURCE_REPO\""
              echo "    branch: \"$SOURCE_BRANCH\""
              echo "    dockerfile: \"$SOURCE_DOCKERFILE\""
            } > "$FILE_NAME"
          else
            {
              echo "metadata:"
              echo "  project: \"$IMAGE_NAME\""
              echo "  version: \"$IMAGE_TAG\""
              echo "  repository-url: \"${REPOSITORY_URI}/${IMAGE_REPO}/${IMAGE_NAME}\""
              echo "  region: \"${AWS_REGION}\""
              echo "  image-hash: \"$FULL_HASH\""
              echo "  group: \"$GROUP\""
              echo "  sdlc-state: \"$SDLC_STATE\""
              echo "  create-fix-pr: false"
            } > "$FILE_NAME"
          fi

          echo "Generated metadata file: ${FILE_NAME}"

      - name: Upload to S3
        run: |
          IMAGE_HASH="${{ github.event.inputs.image_hash }}"
          CLEAN_HASH=$(echo "$IMAGE_HASH" | sed 's/^sha256://')
          FILE_NAME="${CLEAN_HASH}_metadata.yaml"
          S3_PATH="s3://${AWS_BUCKET}/metadata/${FILE_NAME}"

          echo "Uploading ${FILE_NAME} to ${S3_PATH}"
          aws s3 cp "$FILE_NAME" "$S3_PATH" --region "$AWS_REGION"

          echo "Uploaded to: ${S3_PATH}"
```

{% endcode %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veedna.com/sca360-flexible-deployment-for-data-center-cloud-integrated-environments/configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.