AWS inspector medium security documentation change

Service: inspector · 2025-04-25 · Security-related medium

File: inspector/latest/user/dockerfile-checks.md

Summary

Added documentation about OS package database removal checks and AWS secret key pattern example

Security assessment

The addition of checks for package database removal directly addresses a security concern (reduced vulnerability scanning capability). The explicit inclusion of AWS secret key patterns also helps identify credential exposure risks, indicating concrete security improvements.

Diff

diff --git a/inspector/latest/user/dockerfile-checks.md b/inspector/latest/user/dockerfile-checks.md
index 63e775da5..ef13657e2 100644
--- a//inspector/latest/user/dockerfile-checks.md
+++ b//inspector/latest/user/dockerfile-checks.md
@@ -166,0 +167,2 @@ Confidential information in your Dockerfile is considered a hard-coded secret. T
+  * AWS secret keys – `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`
+
@@ -251,0 +254,22 @@ When `wget` is run with the `--no-check-certificate` flag, TLS certificate valid
+### Removal checks for OS package databases within containers
+
+###### Note
+
+The severity rating for this check is **Info**. 
+
+The removal of an operating system package database reduces the ability to scan the complete inventory of a container image's software. These databases should be left intact during container build steps. 
+
+Removal checks for an OS package database is supported for the following package managers: 
+
+###### Alpine Package Keeper (APK)
+
+Container images utilizing the APK package manager for installed software must make sure APK system files are not removed during a build. For more information, see the [APK manpages](https://man.archlinux.org/man/apk.8.en#System_files) system files documentation on the Arch Linux website. 
+
+###### Debian Package Manager (DPKG)
+
+Containers utilizing the DPKG package manager, such as Debian, Ubuntu, or Distroless based images, must make sure the DPKG database are not removed during a container build. For more information, see the [DPKG manpages](https://manpages.ubuntu.com/manpages/trusty/man1/dpkg.1.html#files) system files documentation on the Ubuntu website. 
+
+###### RPM Package Manager (RPM)
+
+Containers utilizing the RPM Package Manager (yum/dnf), such as Amazon Linux or Red Hat Enterprise Linux, must make sure the RPM database is not removed during a container build. For more information, see the [RPM manpages](https://rpm-software-management.github.io/rpm/man/rpm-common.8#FILES) system files documentation on the RPM website. 
+