Hi everyone. I've been evaluating Aqua Security for my company's container workflows, and I'm trying to get my head around two core concepts in their policy engine.
I understand that both vulnerability and image assurance policies are about blocking bad images, but the distinction in the UI has me a bit confused. In my marketing automation world, a rule is a rule, but here the separation seems important.
From reading the docs, I *think* a vulnerability policy is about specific CVEs and severities—like "block any image with a critical CVE in the `nginx` package." It seems very focused on the scan results themselves.
An image assurance policy feels broader, like a compliance checklist. Is it for things like "ensure the image isn't running as root" or "check that it has no secrets embedded," regardless of CVEs? Things that aren't necessarily a *vulnerability* but still a security misconfiguration.
Could someone explain the practical difference in how you'd use each? Maybe an example of a rule that belongs strictly in one type of policy and not the other? I want to make sure I'm setting up our gates correctly for our CI/CD pipeline.