AWS inspector: Document CleanStart hardened image package collection
Summary
Adds a new section describing detection of CleanStart hardened container images via `ID=clnstrt` in `/etc/os-release`, namespacing packages under `clnstrt` (PURL `pkg:apk/clnstrt/<name>@<version>`), and applying hardened-image vendor markers.
Security assessment
The added content documents how the SBOM generator identifies security-hardened images and matches their packages against the correct distribution for vulnerability detection. It improves vulnerability-scanning accuracy for hardened images but does not address a specific vulnerability or incident.
Evidence
+CleanStart images are minimal, security-hardened container images built on an Alpine base. The Amazon Inspector SBOM Generator detects these images and namespaces their packages under `clnstrt` so that vulnerabilities are matched against the hardened distribution.
Diff
diff --git a/inspector/latest/user/sbom-generator-operating-system-collection.md b/inspector/latest/user/sbom-generator-operating-system-collection.md index a6d029b..fe2aa00 100644 --- a//inspector/latest/user/sbom-generator-operating-system-collection.md +++ b//inspector/latest/user/sbom-generator-operating-system-collection.md @@ -7 +7 @@ -Supported operating system artifactsAPK-based OS package collectionDPKG-based OS package collectionRPM-based OS package collectionWindows OS version collectionChainguard image package collectionDistroless image package collectionMinimOS package collectionDocker Hardened Images package collectionRed Hat Hardened Images package collection +Supported operating system artifactsAPK-based OS package collectionDPKG-based OS package collectionRPM-based OS package collectionWindows OS version collectionChainguard image package collectionDistroless image package collectionMinimOS package collectionDocker Hardened Images package collectionRed Hat Hardened Images package collectionCleanStart hardened images package collection @@ -444,0 +445,40 @@ Red Hat Hardened Images detection applies to container, localhost, and volume sc +## CleanStart hardened images package collection + +CleanStart images are minimal, security-hardened container images built on an Alpine base. The Amazon Inspector SBOM Generator detects these images and namespaces their packages under `clnstrt` so that vulnerabilities are matched against the hardened distribution. + +### Detection + +CleanStart images report `ID=clnstrt` in the `/etc/os-release` file. The Amazon Inspector SBOM Generator detects these images directly from this `ID` value. + +###### Example `/etc/os-release` file + +The following is an example of an `/etc/os-release` file for a CleanStart image. + + + ID=clnstrt + ID_LIKE=alpine + +### Package namespace + +Every package in a CleanStart image is namespaced under `clnstrt`, yielding a Package URL of the form `pkg:apk/clnstrt/<name>@<version>`. + +###### Example PURL + +The following is an example package URL for a package in a CleanStart image. + + + pkg:apk/clnstrt/<name>@<version> + +### Hardened-image markers + +When the Amazon Inspector SBOM Generator detects `ID=clnstrt`, it annotates the image with hardened-image markers: + + * The container or operating-system component carries the `amazon:inspector:sbom_generator:hardened_image:vendor` property with a value of `CleanStart`. + + + + +###### Note + +CleanStart detection applies to container, localhost, and volume scans. +