Settings reference (aap.yaml)¶
Every setting maps to one environment variable; a variable already set wins over the file. The file holds no
secrets: credentials come from the secret store (aap secrets put, Kubernetes secrets, Key Vault).
aap.yaml key |
Environment variable | Allowed values |
|---|---|---|
env |
AAP_ENV |
development / production |
public_url |
AAP_PUBLIC_URL |
pattern ^https?:// |
database.url_file |
AAP_DATABASE_URL_FILE |
string — Path to a file holding the database URL (e.g. a mounted Kubernetes secret) |
auth.mode |
AAP_AUTH_MODE |
oidc / dev |
auth.oidc.issuer |
AAP_OIDC_ISSUER |
pattern ^https?:// |
auth.oidc.client_id |
AAP_OIDC_CLIENT_ID |
string |
auth.oidc.tenant_id |
AAP_OIDC_TENANT_ID |
string |
auth.oidc.api_audience |
AAP_OIDC_API_AUDIENCE |
string |
auth.oidc.client_auth |
AAP_OIDC_CLIENT_AUTH |
managed_identity / secret |
auth.oidc.internal_url |
AAP_OIDC_INTERNAL_URL |
pattern ^https?://[^/]+/?$ — back-channel origin for discovery, keys and token calls |
secrets.backend |
AAP_SECRETS_BACKEND |
file / mounted / keyvault |
secrets.dir |
AAP_SECRETS_DIR |
string |
secrets.keyvault_url |
AAP_KEYVAULT_URL |
pattern ^https:// |
worker.scheduler_interval |
AAP_SCHEDULER_INTERVAL |
integer — Seconds between scheduler sweeps: integration syncs that are due, deadline breaches, exception expiry, re-evaluation, snapshot refresh and evidence chain verification (default 300) |
evidence_store.kind |
AAP_BLOB_KIND |
local / azure / s3 |
evidence_store.root |
AAP_BLOB_ROOT |
string |
evidence_store.container |
AAP_BLOB_CONTAINER |
string |
evidence_store.account_url |
AAP_BLOB_ACCOUNT_URL |
pattern ^https:// |
evidence_store.bucket |
AAP_BLOB_S3_BUCKET |
string |
evidence_store.prefix |
AAP_BLOB_S3_PREFIX |
string |
evidence_store.endpoint_url |
AAP_BLOB_S3_ENDPOINT |
pattern ^https?:// |
evidence_store.region |
AAP_BLOB_S3_REGION |
string |
azure.client_id |
AAP_AZURE_CLIENT_ID |
string — User-assigned managed identity client id |
plugins.github.org |
AAP_GITHUB_ORG |
string |
plugins.github.app_client_id |
AAP_GITHUB_APP_CLIENT_ID |
string |
plugins.github.app_key_id |
AAP_GITHUB_APP_KEY_ID |
string — Key Vault key id of the App's signing key |
plugins.github.api_url |
AAP_GITHUB_API |
pattern ^https:// |
plugins.jira.url |
AAP_JIRA_URL |
pattern ^https?:// |
plugins.jira.email |
AAP_JIRA_EMAIL |
string |
plugins.dependency_track.url |
AAP_DT_URL |
pattern ^https?:// |
plugins.defectdojo.url |
AAP_DD_URL |
pattern ^https?:// |
plugins.azure_defender.subscriptions |
AAP_AZURE_SUBSCRIPTIONS |
array |
plugins.aws_securityhub.role_arn |
AAP_AWS_ROLE_ARN |
pattern ^arn:aws |
plugins.aws_securityhub.accounts |
AAP_AWS_ACCOUNTS |
array |
plugins.aws_securityhub.web_identity_audience |
AAP_AWS_WEB_IDENTITY_AUDIENCE |
string |
plugins.sentinel.dce |
AAP_SENTINEL_DCE |
pattern ^https:// |
plugins.sentinel.dcr_id |
AAP_SENTINEL_DCR_ID |
string |
plugins.siem_http.url |
AAP_SIEM_HTTP_URL |
pattern ^https:// |
plugins.siem_http.format |
AAP_SIEM_HTTP_FORMAT |
json / splunk_hec |
plugins.syslog.address |
AAP_SIEM_SYSLOG |
pattern ^[^:/ ]+:[0-9]{1,5}$ |
plugins.syslog.ca_file |
AAP_SIEM_SYSLOG_CA |
string |
plugins.gitlab.url |
AAP_GITLAB_URL |
pattern ^https?:// |
plugins.gitlab.group |
AAP_GITLAB_GROUP |
string |
plugins.github_issues.enabled |
AAP_GITHUB_ISSUES |
on |