AWS inspector documentation change
Summary
Restructured documentation to provide an overview of SBOM Generator capabilities, expanded ecosystem support details (including Windows paths for Apache/Node.js), added concrete installation examples, removed PURL examples, and clarified detection methods for WordPress/Node.js components.
Security assessment
Changes focus on improving documentation structure, expanding detection path examples, and clarifying capabilities rather than addressing security vulnerabilities or introducing new security features. While SBOM generation is security-adjacent, there is no evidence of patching a vulnerability or responding to a specific security incident.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index b58d374f1..cbb317332 100644 --- a/inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b/inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -5 +5 @@ -Supported ecosystemsApache ecosystem collectionJava ecosystem collectionGoogle ecosystem collectionWordPress ecosystem collectionNode.JS runtime collection +Overview of Amazon Inspector SBOM Generator capabilities @@ -9 +9 @@ Supported ecosystemsApache ecosystem collectionJava ecosystem collectionGoogle e -The Amazon Inspector SBOM Generator is a tool for creating a software bill of materials (SBOM) and performing vulnerability scanning for supported packages from operating systems and programming languages. It also supports the scanning of various ecosystems beyond core operating systems, ensuring a robust and detailed analysis of infrastructure components. By generating an SBOM, users can understand the composition of their modern technology stacks, identify vulnerabilities in ecosystem components, and gain visibility into third party software. +The Amazon Inspector SBOM Generator is a tool for creating a software bill of materials (SBOM) and performing vulnerability scanning of supported packages from operating systems, programming languages, and additional ecosystems. This topic describes the capabilities of the Amazon Inspector SBOM Generator, focusing on supported ecosystems. @@ -11 +11 @@ The Amazon Inspector SBOM Generator is a tool for creating a software bill of ma -## Supported ecosystems +## Overview of Amazon Inspector SBOM Generator capabilities @@ -13 +13,5 @@ The Amazon Inspector SBOM Generator is a tool for creating a software bill of ma -The ecosystem collection extends SBOM generation beyond packages installed through OS package managers. This is done through the collection of applications deployed in alternative methods, such as manual installation. The Amazon Inspector SBOM Generator supports scanning for the following ecosystems: +The Amazon Inspector SBOM Generator supports scanning of various ecosystems beyond core operating systems, ensuring a robust and detailed analysis of infrastructure components. By generating an SBOM, users can understand the composition of their modern technology stacks, identify vulnerabilities in ecosystem components, and gain visibility into third party software. + +### Supported ecosystems + +The Amazon Inspector SBOM Generator supports scanning for the following ecosystems: @@ -23 +27 @@ Node.JS | node -## Apache ecosystem collection +#### Apache ecosystem collection @@ -30,0 +35,2 @@ The Amazon Inspector SBOM Generator scans for Apache installations that are in c + * Windows: `/Program Files/Apache Software Foundation/` and `/Program Files (x86)/Apache Software Foundation/` + @@ -52 +58 @@ The Amazon Inspector SBOM Generator scans for Apache installations that are in c -###### Example `ap_release.h` file +###### Example Apache Tomcat httpd @@ -71,9 +77 @@ The following is an example of the content inside of the `ap_release.h` file. -###### Example PURL - -The following is an example package URL for an `Apache httpd` application. - - - Sample PURL: pkg:generic/apache/[email protected] - - -###### Example `catalina.jar/META-INF/MANIFEST.MF` file +###### Example Apache Tomcat @@ -93,9 +91 @@ The following is an example of the content inside of the `catalina.jar/META-INF/ -###### Example PURL - -The following is an example package URL for an `Apache Tomcat` application. - - - Sample PURL: pkg:generic/apache/[email protected] - - -## Java ecosystem collection +#### Java ecosystem collection @@ -138 +128 @@ The Amazon Inspector SBOM Generator scans for Java installations across the foll -###### Example Java version information +###### Example Amazon Corretto @@ -166,15 +156 @@ The folllowing is an example of an Oracle Java release. -###### Example PURL - -The following is an example package URL for an Oracle Java release. - - - Sample PURL: - # Amazon Corretto - pkg:generic/amazon/[email protected] - # Oracle JDK - pkg:generic/oracle/[email protected] - # Oracle JRE - pkg:generic/oracle/jre@20 - - -## Google ecosystem collection +#### Google ecosystem collection @@ -194,0 +171,2 @@ Amazon Inspector collects Google Chrome information from the following: + * The `chrome.exe` version information (installation) + @@ -202 +180 @@ The Amazon Inspector SBOM Generator parses and collects corresponding versions o -###### Example `chrome/VERSION` version file +###### Example Google Chrome @@ -204 +182 @@ The Amazon Inspector SBOM Generator parses and collects corresponding versions o -The following is an example of the `chrome/VERSION` version file. +The following is an example of the `chrome/VERSION` file. @@ -213,9 +191 @@ The following is an example of the `chrome/VERSION` version file. -###### Example PURL - -The following is an example package URL for a `chrome/VERSION` version file. - - - Sample PURL: pkg:generic/google/[email protected] - - -###### Example `puppeteer` version file +###### Example Google Chrome @@ -238 +208 @@ The following is an example of the `puppeteer` version file. -###### Example PURL +###### Example Google Chrome @@ -240 +210 @@ The following is an example of the `puppeteer` version file. -The following is an example package URL for a `puppeteer` version file. +The following is an example of the `chrome.exe` version information. @@ -243 +213 @@ The following is an example package URL for a `puppeteer` version file. - Sample PURL: pkg:generic/google/[email protected] + # Sample chrome properties @@ -244,0 +215,8 @@ The following is an example package URL for a `puppeteer` version file. + File description: Google Chrome + Type: Application + File version: 131.0.6778.86 + Copyright: Copyright 2024 Google LLC. All rights reserved + Size: 2.86 MB + Date modified: 11/19/2024 2:25 AM + Language: English (United States) + Original filename: chrome.exe @@ -246 +224,2 @@ The following is an example package URL for a `puppeteer` version file. -## WordPress ecosystem collection + +#### WordPress ecosystem collection @@ -261 +240,5 @@ The following is an example package URL for a `puppeteer` version file. - * WordPress core – parses the `/wp-includes/version.php` file to extract version value from $wp_version variable. + * For WordPress core, parses the `/wp-includes/version.php` file to extract version value from $wp_version variable. + + * For WordPress plugins, parses the `/wp-content/plugins/<WordPress Plugin>/readme.txt` file or `/wp-content/plugins/<WordPress Plugin>/readme.md` file to extract the `Stable` tag as the version string. + + * For WordPress themes, parses the `/wp-content/themes/<WordPress Theme>/style.css` file to extract the version from the version metadata. @@ -263 +245,0 @@ The following is an example package URL for a `puppeteer` version file. - * WordPress plugins – parses the `/wp-content/plugins/<WordPress Plugin>/readme.txt` file or `/wp-content/plugins/<WordPress Plugin>/readme.md` file to extract the `Stable` tag as the version string. @@ -265 +246,0 @@ The following is an example package URL for a `puppeteer` version file. - * WordPress themes – parses the `/wp-content/themes/<WordPress Theme>/style.css` file to extract the version from the version metadata. @@ -267,0 +249 @@ The following is an example package URL for a `puppeteer` version file. +###### Installation path @@ -268,0 +251 @@ The following is an example package URL for a `puppeteer` version file. + * For WordPress core, identifies the directory path containing the WordPress core @@ -270 +253 @@ The following is an example package URL for a `puppeteer` version file. -###### Example `version.php` file + * For WordPress plugins, identifies the directory path containing the WordPress plugins. @@ -272 +255,8 @@ The following is an example package URL for a `puppeteer` version file. -The following is an example of a WordPress core `version.php` file. + * For WordPress themes, identifies the directory path containing the WordPress themes. + + + + +###### Example WordPress Core + +The following is an example of a WordPress Core `version.php` file. @@ -290,4 +280 @@ The following is an example of a WordPress core `version.php` file. -###### Example PURL - -The following is an example package URL for WordPress core. - +###### Example WordPress Core @@ -295,6 +282 @@ The following is an example package URL for WordPress core. - Sample PURL: pkg:generic/wordpress/core/[email protected] - - -###### Example `readme.txt` file - -The following is an example of a WordPress plugin `readme.txt` file. +The following is an example a WordPress Core `readme.txt` file. @@ -317,7 +299 @@ The following is an example of a WordPress plugin `readme.txt` file. -###### Example PURL - -The following is an example package URL for a WordPress plugin. - - - Sample PURL: pkg:generic/wordpress/plugin/[email protected] - +###### Example WordPress Core @@ -325,3 +301 @@ The following is an example package URL for a WordPress plugin. -###### Example `style.css` file - -The following is an example of a WordPress theme `style.css` file. +The following is an example of a WordPress Core `style.css` file. @@ -345,9 +319 @@ The following is an example of a WordPress theme `style.css` file. -###### Example PURL - -The following is an example package URL for a WordPress theme. - - - Sample PURL: pkg:generic/wordpress/theme/[email protected] - - -## Node.JS runtime collection +#### Node.JS runtime collection @@ -364 +330,3 @@ The following is an example package URL for a WordPress theme. - * MacOS and Linux – `node` binary detection through binary details installed with `asdf`, `fnm`, `nvm`, or `volta` + * MacOS and Linux – `node.exe` binary detection through binary details installed with asdf, fnm, nvm, or volta. + + * Windows – `node.exe` binary detection through binary details installed with with official MSI (32bit and 64bit) or fnm (64bit). @@ -371 +339 @@ The following is an example package URL for a WordPress theme. -Docker images or images by node.js publisher are unsupported. These images do not contain reliable artifacts. You can view examples of these images on the [Dockerhub](https://hub.docker.com/_/node) and [GitHub](https://github.com/nodejs/docker-node/blob/12a54cd19fc05ecaf5a9aecc9e5280a37057835f/22/alpine3.21/Dockerfile#L23-L26). +Images based on Docker images on Dockerhub are unsupported. These images do not contain reliable artifacts. You can view examples of these images on the [Dockerhub](https://hub.docker.com/_/node) and [GitHub](https://github.com/nodejs/docker-node/blob/12a54cd19fc05ecaf5a9aecc9e5280a37057835f/22/alpine3.21/Dockerfile#L23-L26). @@ -373 +341 @@ Docker images or images by node.js publisher are unsupported. These images do no -###### Example MacOS and Linux paths +###### Example MacOS and Linux @@ -385 +353,13 @@ The following is an example of paths for MacOS and Linux. -###### Example PURL +###### Example Windows + +The following is an example of paths for Windows. + + + MSI: C:\Program Files\nodejs\ + MSI: C:\Program Files (x86)\nodejs\