AWS inspector: Clarify SBOM license collection for nested and non-license values
Summary
Adds notes explaining that nested child components (e.g., DPKG/RPM binary packages under a source package) each report their own license, and that non-license values such as SPDX `NOASSERTION`/`NONE` and full license text are ignored rather than recorded.
Security assessment
This is purely a behavioral clarification of license metadata collection in the SBOM generator output. License reporting is a compliance concern, not a vulnerability, credential, or access-control issue, so no security relevance is indicated.
Evidence
+Values that do not name a license are ignored rather than recorded. This includes the SPDX `NOASSERTION` and `NONE` assertions and the full text of a license.
Diff
diff --git a/inspector/latest/user/sbom-generator-license-collection.md b/inspector/latest/user/sbom-generator-license-collection.md index 0875c07..2dd034a 100644 --- a//inspector/latest/user/sbom-generator-license-collection.md +++ b//inspector/latest/user/sbom-generator-license-collection.md @@ -42,0 +43,4 @@ The following example shows a component entry in the generated SBOM. +###### Note + +When a package nests child components – for example DPKG and RPM binary packages under a source package – each child reports its own license rather than inheriting the parent's license or being omitted. Nested-component license reporting applies to container, localhost, and volume scans run with `--collect-licenses`. + @@ -194,0 +199,4 @@ Custom exceptions are prefixed with `AdditionRef-`, such as `AdditionRef-CustomE +###### Non-license values + +Values that do not name a license are ignored rather than recorded. This includes the SPDX `NOASSERTION` and `NONE` assertions and the full text of a license. +