AWS inspector documentation change
Summary
Added support for three new ecosystems (HuggingFace, MongoDB, Redis), updated Microsoft applications section to include .NET Framework and correct .NET Core Runtime, fixed typos, and added detailed documentation for each new ecosystem including supported applications, key features, and example package URLs.
Security assessment
The changes expand the list of supported ecosystems for SBOM generation, which is a software inventory feature. There is no evidence in the diff of addressing a specific security vulnerability, weakness, or incident. The updates are routine documentation enhancements to support new software ecosystems and correct existing documentation. While SBOM generation supports security posture by improving software visibility, the changes themselves do not document security fixes or vulnerabilities.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index 9edde1233..fc2ae3947 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -5 +5 @@ -Supported ecosystems7-Zip ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionCurl ecosystem collectionElasticsearch ecosystem collectionGoogle ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionWordPress ecosystem collection +Supported ecosystems7-Zip ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionCurl ecosystem collectionElasticsearch ecosystem collectionGoogle ecosystem collectionHuggingFace ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionMongoDB ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionRedis ecosystem collectionWordPress ecosystem collection @@ -22,0 +23 @@ Google | Chrome +HuggingFace | HuggingFace CLI Models Cache @@ -26 +27,2 @@ MariaDB and MySQL | MariaDB Server (10.6+, 11.x, 12.x) Oracle MySQL Server Serv -Microsoft applications | PowerShell NuGet CLI Visual Studio Code Microsoft Edge SharePoint Server Microsoft Defender Exchange Server Visual Studio .NET Runtime ASP.NET Core Runtime Microsoft Teams Outlook for Windows Microsoft Office Microsoft 365 +Microsoft applications | PowerShell NuGet CLI Visual Studio Code Microsoft Edge SharePoint Server Microsoft Defender Exchange Server Visual Studio .NET Core Runtime .NET Framework ASP.NET Core Runtime Microsoft Teams Outlook for Windows Microsoft Office Microsoft 365 +MongoDB | MongoDB Server (7.0+, 8.0+) @@ -33,0 +36 @@ PHP | PHP (version 8.1 and higher) +Redis | Redis (version 7.2 and higher) @@ -553,0 +557,34 @@ The following is an example package URL with skip qualifier for a `puppeteer` ve +## HuggingFace ecosystem collection + +###### Supported applications + + * HuggingFace `hf` CLI + + + + +###### Key features + + * Extracts locally cached AI/ML models installed by HuggingFace + + * Generates HuggingFace Package URLs + + * Models downloaded using `hf download --local-dir` are not currently supported + + + + +###### Example path + +The following is an example of a cached HuggingFace model path. + + + /home/ec2-user/.cache/huggingface/hub/models--MiniMaxAI--MiniMax-M2.5/snapshots/<hash> + +###### Example PURL + +The following is an example package URL for a HuggingFace model. The component type is `machine-learning-model`. + + + pkg:huggingface/MiniMaxAI/MiniMax-M2.5@<hash> + @@ -851 +888,3 @@ The following Microsoft applications are inventoried by the Amazon Inspector SBO - * .NET Runtime + * .NET Core Runtime + + * .NET Framework @@ -880 +919 @@ The following Microsoft applications are inventoried by the Amazon Inspector SBO - * Exhange Server – Examines the `Exsetup.exe` file to extract the embedded version information. + * Exchange Server – Examines the `Exsetup.exe` file to extract the embedded version information. @@ -884 +923 @@ The following Microsoft applications are inventoried by the Amazon Inspector SBO - * .NET Runtime – Searches for `Microsoft.NETCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. + * .NET Core Runtime – Searches for `Microsoft.NETCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. @@ -888 +927,21 @@ The following Microsoft applications are inventoried by the Amazon Inspector SBO - * ASP.NET Runtime – Searches for `Microsoft.AspNetCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. + * .NET Framework – Parses Windows Registry and reads file metadata to detect installed .NET Framework versions. The scanner checks the following registry key and value, and files. + + * **Registry Key** (<VERSION_SUB_KEY> represents the .NET Framework version, such as v2.0.50727, v3.5, or v4\Full) + + HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\<VERSION_SUB_KEY> + + HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\<VERSION_SUB_KEY> + + * **Registry Value** + + * Install – Indicates whether the .NET Framework version is installed. + + * Version – Installed .NET Framework version (version 4.0 or lower) + + * Release – A REG_DWORD value that maps to the installed .NET Framework version (version 4.5 or later) + + * **DLL Files** + +The scanner extracts the file version from `mscorlib.dll` and `System.dll`. If these files exist, they are added to the SBOM as nested file components. For .NET Framework version 4.5 or later, the largest file version among files is reported as the version. + + * ASP.NET Core Runtime – Searches for `Microsoft.AspNetCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. @@ -904 +963 @@ The following Microsoft applications are inventoried by the Amazon Inspector SBO - KEY_LOCAL_MACHINES\SOFTWARE\Microsoft\Office\ClickToRun\Configuration + HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration @@ -980 +1039 @@ The following is an example package URL for each Microsoft Applications. - // .NET Runtime + // .NET Core Runtime @@ -982,0 +1042,3 @@ The following is an example package URL for each Microsoft Applications. + // .NET Framework + Sample PURL: pkg:generic/microsoft/[email protected] + @@ -1006,0 +1069,54 @@ The following is an example package URL for each Microsoft Applications. +## MongoDB ecosystem collection + +###### Supported applications + + * MongoDB Server (7.0+, 8.0+) + + + + +###### Key features + + * Examines mongod binaries to extract embedded version information. + + + + +###### Note + +The mongod binary can exceed 200 MB in size. To scan for MongoDB, the Amazon Inspector SBOM Generator file size limit must be configured to allow files over 200 MB. + +The Amazon Inspector SBOM Generator looks for MongoDB installations in common installation paths across platforms: + +###### Linux + + * `/usr/bin/mongod` + + * `/usr/local/bin/mongod` + + + + +###### macOS + + * `/usr/local/bin/mongod` + + * `/opt/homebrew/bin/mongod` + + + + +###### Windows + + * `C:\Program Files\MongoDB\Server\bin\mongod.exe` + + + + +###### Example PURL + +The following is an example package URL for MongoDB Server. + + + pkg:generic/mongodb/[email protected]?platform=linux + @@ -1366,0 +1483,54 @@ The following is an example package URL for a PHP pattern. +## Redis ecosystem collection + +###### Supported applications + + * Redis (version 7.2 and higher) + + + + +###### Key features + + * Extracts version information from Redis `redis-server` binary executables using embedded version strings. + + * Searches for version strings in the binary executable `.rodata` section (for ELF binaries on Linux) or `__cstring` section (for Mach-O binaries on macOS). + + + + +The Amazon Inspector SBOM Generator looks for Redis installations in common installation paths across platforms: + +###### Linux + + * `/usr/bin/redis-server` + + * `/usr/local/bin/redis-server` + + + + +###### macOS + + * `/opt/homebrew/bin/redis-server` + + * `/usr/local/bin/redis-server` + + + + +###### Example version string + +The following is an example of a version string embedded in a Redis binary. + + + redis-7.2.6 + +Version `7.2.6` is extracted to identify the Redis version. + +###### Example PURL + +The following is an example package URL for Redis.