AWS inspector documentation change
Summary
Added documentation for 9 new ecosystem collections (Amazon Q Developer, Claude Code, Conda, Docker binaries, Generic AI/ML Models, GitHub Copilot, Kiro CLI, Ollama, Ollama Model Collector) and expanded existing Apache ecosystem with Cassandra and Struts support. Included details about supported applications, detection methods, installation paths, and example PURLs for each ecosystem.
Security assessment
This change documents expanded SBOM generation capabilities for security tools, enabling better vulnerability detection in software supply chains. It adds details about security-relevant components like Docker binaries and AI/ML models but doesn't address any specific vulnerability or security incident.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index 5470584b9..f0724712d 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -7 +7 @@ -Supported ecosystems7-Zip ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionCurl ecosystem collectionElasticsearch ecosystem collectionGoogle ecosystem collectionHuggingFace ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionMicrosoft SQL Server ecosystem collectionMongoDB ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionRedis ecosystem collectionWordPress ecosystem collection +Supported ecosystems7-Zip ecosystem collectionAmazon Q Developer ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionClaude Code ecosystem collectionConda ecosystem collectionCurl ecosystem collectionDocker binaries ecosystem collectionElasticsearch ecosystem collectionGeneric AI/ML Models ecosystem collectionGitHub Copilot ecosystem collectionGoogle ecosystem collectionHuggingFace ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionKiro CLI ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionMicrosoft SQL Server ecosystem collectionMongoDB ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOllama ecosystem collectionOllama Model Collector ecosystem collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionRedis ecosystem collectionWordPress ecosystem collection @@ -20 +20,3 @@ Ecosystems | Applications -Apache | Apache httpd Apache tomcat +Amazon Q Developer | Amazon Q Developer CLI Amazon Q VS Code extension Amazon Q JetBrains plugin +Anthropic | Claude Code CLI +Apache | Apache Cassandra Apache httpd Apache Struts Apache tomcat @@ -21,0 +24 @@ Atlassian | Jira Core Confluence Jira Software Jira Service Management +Conda | Miniconda environments Anaconda environments Miniforge environments Mambaforge environments @@ -22,0 +26 @@ Curl | Curl Libcurl +Docker binaries | docker dockerd containerd runc @@ -23,0 +28,2 @@ Elasticsearch | Elasticsearch +Generic AI/ML Models | `.gguf` – GGUF `.safetensors` – Safetensors `.onnx` – ONNX `.pt` – PyTorch `.pth` – PyTorch `.h5` – Keras / HDF5 +GitHub | GitHub Copilot CLI GitHub Copilot VS Code extension GitHub Copilot JetBrains plugin @@ -27,0 +34 @@ Jenkins | Jenkins (version 2.400.* and higher) +Kiro | Kiro CLI @@ -34,0 +42 @@ Node.JS | node +Ollama | Ollama Ollama Model Collector @@ -89,0 +98,57 @@ The following is an example package URL for 7-Zip. +## Amazon Q Developer ecosystem collection + +###### Supported applications + + * Amazon Q Developer CLI + + * Amazon Q VS Code extension + + * Amazon Q JetBrains plugin + + + + +###### Key features + + * Examines the `q` CLI binary for the embedded `AmazonQ-For-CLI` identity string and extracts the version from AWS tooling user-agent metadata. + + * For IDE extensions, parses `package.json` (VS Code) and `META-INF/plugin.xml` (JetBrains) to extract the version. + + + + +###### Supported platforms + +The Amazon Inspector SBOM Generator scans for installations in common installation paths across platforms: + +###### Linux and macOS + + * `~/.local/bin/q` + + * `/usr/local/bin/q` + + * `~/.vscode/extensions/amazonwebservices.amazon-q-vscode-*/` + + * `<IDE>/plugins/amazon-q/META-INF/plugin.xml` + + + + +###### Windows + + * `%APPDATA%\npm\q.cmd` + + * `%USERPROFILE%\.vscode\extensions\amazonwebservices.amazon-q-vscode-*\` + + * `%APPDATA%\JetBrains\<IDE>\plugins\amazon-q\` + + + + +###### Example PURL + +The following is an example package URL for Amazon Q Developer. + + + Sample PURL: pkg:generic/amazon/[email protected]?distro=linux + @@ -92 +157,75 @@ The following is an example package URL for 7-Zip. -This section provides details about Apache httpd and Apache tomcat applicatons. +This section provides details about Apache Cassandra, Apache httpd, Apache Struts, and Apache tomcat applicatons. + +### Apache Cassandra + +###### Supported applications + + * Apache Cassandra + + + + +###### Key features + + * Discovers `apache-cassandra-<specific.version>.jar` files and unpacks them to extract the version string from the `Implementation-Version` entry inside the `META-INF/MANIFEST.MF` file. + + + + +###### Supported platforms + +The Amazon Inspector SBOM Generator scans for installations in common installation paths across platforms: + +###### Linux + + * `/usr/share/cassandra/lib/` + + * `/opt/cassandra/lib/` + + + + +###### macOS + + * `/opt/homebrew/Cellar/cassandra/` + + * `/usr/local/Cellar/cassandra/` + + + + +###### Windows + + * `/Program Files/cassandra/lib/` + + * `/Program Files/apache-cassandra/lib/` + + * `/Program Files (x86)/cassandra/lib/` + + * `/Program Files (x86)/apache-cassandra/lib/` + + + + +###### Example `apache-cassandra-<specific.version>.jar/META-INF/MANIFEST.MF` file + +The following is an example of content inside an `apache-cassandra-<specific.version>.jar/META-INF/MANIFEST.MF` file. + + + //truncated + + Manifest-Version: 1.0 + Implementation-Title: Cassandra + Implementation-Version: 4.1.3 + Implementation-Vendor: Apache + + //truncated + + +###### Example PURL + +The following is an example package URL for an `Apache Cassandra` application. + + + Sample PURL: pkg:generic/apache/[email protected] + @@ -162,0 +302,71 @@ The following is an example package URL for an `Apache httpd` application. +### Apache Struts + +###### Supported applications + + * Apache Struts + + + + +###### Key features + + * Discovers `struts2-core-<specific.version>.jar` files (typically deployed inside a web application's `WEB-INF/lib/` directory on a Java application server) and unpacks them to extract the version string from the `Implementation-Version` entry inside the `META-INF/MANIFEST.MF` file. + + + + +###### Supported platforms + +The Amazon Inspector SBOM Generator scans for installations in common Java application server paths across platforms: + +###### Linux + + * `/opt/tomcat/` + + * `/usr/share/tomcat/` + + * `/var/lib/tomcat/` + + * `/usr/local/tomcat/` + + * `/opt/wildfly/` + + * `/opt/jboss/` + + * `/opt/jetty/` + + + + +###### Windows +