AWS inspector documentation change
Summary
Added new CycloneDX namespace properties for Amazon Inspector SBOM Generator including image configuration details (CMD, ENTRYPOINT, WORKDIR), subscription information, and cloud metadata from IMDS for AWS and Azure instances.
Security assessment
This change enhances documentation for Amazon Inspector's SBOM (Software Bill of Materials) generator by documenting new metadata fields that can be included in security reports. While SBOMs are security tools for vulnerability management, this change documents additional data points (like image configuration and cloud metadata) that improve security visibility and compliance. There is no evidence this addresses a specific security vulnerability; rather it expands documentation of existing security feature capabilities.
Diff
diff --git a/inspector/latest/user/cyclonedx-namespace.md b/inspector/latest/user/cyclonedx-namespace.md index 0dd83c7fa..248db3cf2 100644 --- a//inspector/latest/user/cyclonedx-namespace.md +++ b//inspector/latest/user/cyclonedx-namespace.md @@ -47,0 +48,3 @@ The Amazon Inspector SBOM Generator uses the `amazon:inspector:sbom_generator` n +`amazon:inspector:sbom_generator:image:cmd:`count`` | An absolute directory within the container image defined in default CMD configured at image build time. +`amazon:inspector:sbom_generator:image:entrypoint:`count`` | An absolute directory within the container image defined in default ENTRYPOINT configured at image build time. +`amazon:inspector:sbom_generator:image:workdir` | The WORKDIR directory of the container image configured at image build time. @@ -63,0 +67,3 @@ The Amazon Inspector SBOM Generator uses the `amazon:inspector:sbom_generator` n +`amazon:inspector:sbom_generator:subscription:enabled` | A boolean value indicating whether a subscription is enabled, such as RHEL EUS/E4S or Ubuntu Pro. +`amazon:inspector:sbom_generator:subscription:name` | The name of the active subscription (e.g., EUS, E4S, Pro). +`amazon:inspector:sbom_generator:subscription:locked_version` | The version locked by the active RHEL subscription (RHEL EUS/E4S only). @@ -81,0 +88,2 @@ The Amazon Inspector SBOM Generator uses the `amazon:inspector:sbom_generator` n +`amazon:inspector:sbom_generator:metadata:imds:account_id` | The AWS account ID of the Amazon EC2 instance, obtained from the instance identity document (AWS only). +`amazon:inspector:sbom_generator:metadata:imds:resource_type` | The type of cloud resource being scanned (e.g., aws_ec2_instance). @@ -83,0 +92,2 @@ The Amazon Inspector SBOM Generator uses the `amazon:inspector:sbom_generator` n +`amazon:inspector:sbom_generator:metadata:imds:resource_group` | The Azure resource group the instance belongs to (Azure only). +`amazon:inspector:sbom_generator:metadata:imds:subscription_id` | The Azure subscription ID associated with the instance (Azure only).