AWS inspector: Sbomgen: add CIS Docker Benchmark and FIPS check docs
Summary
Adds Homebrew package type support, new `--enable-cis-docker` and `--enable-fips-checks` experimental arguments that record CIS Docker Benchmark results and FIPS cryptographic configuration indicators on components, and documents `--continue-on-layer-size-exceeded` layer-skip behavior including its whiteout semantics.
Security assessment
The change documents new security-posture/configuration assessment capabilities: CIS Docker Benchmark checks (host/container hardening controls 4.1, 4.6, 4.7, 4.9, 4.10) and FIPS-related cryptographic indicators (crypto policy, kernel FIPS mode, certified OS, STIG crypto subpolicy). This is compliance/hardening documentation rather than a fix for a specific vulnerability, so it is security documentation of a medium-impact hardening feature. The skipped-layer note is also a correctness caveat that could affect inventory completeness, not a direct vulnerability.
Evidence
+Sbomgen can also evaluate supported CIS Docker Benchmark checks on a container image with the `--enable-cis-docker` argument, and record indicators that describe a system's FIPS-related cryptographic configuration on Linux container and localhost scans with the `--enable-fips-checks` argument. Both arguments are experimental and disabled by default. For more information, see Evaluate CIS Docker Benchmark checks and Record FIPS configuration indicators.
Diff
diff --git a/inspector/latest/user/sbom-generator.md b/inspector/latest/user/sbom-generator.md index a12c938..53b0ecc 100644 --- a//inspector/latest/user/sbom-generator.md +++ b//inspector/latest/user/sbom-generator.md @@ -24,0 +25,2 @@ Sbomgen collects inventory for the following package types: + * Homebrew + @@ -47,0 +50,2 @@ Sbomgen can scan standalone Dockerfiles and build history from exisiting images +Sbomgen can also evaluate supported CIS Docker Benchmark checks on a container image with the `--enable-cis-docker` argument, and record indicators that describe a system's FIPS-related cryptographic configuration on Linux container and localhost scans with the `--enable-fips-checks` argument. Both arguments are experimental and disabled by default. For more information, see Evaluate CIS Docker Benchmark checks and Record FIPS configuration indicators. + @@ -343,0 +348,17 @@ Both arguments apply to container scans only and are independent of each other. +By default, a layer whose compressed size exceeds `--layer-max-pull-size` causes Sbomgen to reject the whole image. To skip the oversized layer and continue inventorying the rest of the image instead, add the `--continue-on-layer-size-exceeded` argument. It has no effect unless `--layer-max-pull-size` is set, and `--image-max-pull-size` still rejects an oversized image. + +Each skipped layer is reported as a `data` sub-component of the image metadata component, named by its diff ID, with the following properties: + + * `amazon:inspector:sbom_generator:layer:skip_reason` – Why the layer was skipped (`layer_size_exceeded`). + + * `amazon:inspector:sbom_generator:layer:size_bytes` – The size of the skipped layer. + + * `amazon:inspector:sbom_generator:layer:size_limit_bytes` – The limit that the layer exceeded. + + + + +###### Note + +A skipped layer's whiteouts are not applied, so a path that the layer deletes or replaces is reported as the layer beneath it left it. + @@ -354,0 +376,11 @@ The following example rejects the image if the compressed sizes of its layers to +###### Example + +The following example skips any layer larger than 10 GiB (`10737418240` bytes) and inventories the remaining layers instead of rejecting the image. + + + # Skip oversized layers instead of rejecting the image + ./inspector-sbomgen container --image image:tag \ + --outfile /tmp/sbom.json \ + --layer-max-pull-size 10737418240 \ + --continue-on-layer-size-exceeded + @@ -416,0 +449,64 @@ The following example shows how to use the `--collect-processes` argument. +### Evaluate CIS Docker Benchmark checks + +When you scan a container image, you can use the `--enable-cis-docker` argument to evaluate supported CIS Docker Benchmark checks and record the result of each check as a property on the container component. + +###### Note + +This argument is experimental, applies to container scans only, and is disabled by default. + +Sbomgen records the following properties on the container component, where `check` is the identifier of an individual check: + + * `amazon:inspector:sbom_generator:image:cis:docker:`check`` – The `pass` or `fail` result of an individual check, one per supported check (currently 4.1, 4.6, 4.7, 4.9, and 4.10). + + * `amazon:inspector:sbom_generator:image:cis:docker:checks_passed` – The number of evaluated checks that passed. + + + + +###### Example + +The following example shows how to use the `--enable-cis-docker` argument. + + + # Evaluate CIS Docker Benchmark checks + ./inspector-sbomgen container --image image:tag \ + --outfile /tmp/sbom.json \ + --enable-cis-docker + +### Record FIPS configuration indicators + +When you scan a Linux container image or localhost, you can use the `--enable-fips-checks` argument to record indicators that describe the system's FIPS-related cryptographic configuration. + +###### Note + +This argument is experimental, applies to Linux container and localhost scans only, and is disabled by default. + +Sbomgen records the following properties, each valued `pass`, `fail`, or `unknown`: + + * `amazon:inspector:sbom_generator:fips:aide_fips_hashes` + + * `amazon:inspector:sbom_generator:fips:boot_fips_arg` + + * `amazon:inspector:sbom_generator:fips:crypto_policy_fips` + + * `amazon:inspector:sbom_generator:fips:dracut_fips_module` + + * `amazon:inspector:sbom_generator:fips:kernel_fips_enabled` + + * `amazon:inspector:sbom_generator:fips:os_fips_certified` + + * `amazon:inspector:sbom_generator:fips:stig_crypto_subpolicy` + + + + +###### Example + +The following example shows how to use the `--enable-fips-checks` argument on a localhost scan. + + + # Record FIPS configuration indicators + ./inspector-sbomgen localhost \ + --outfile /tmp/sbom.json \ + --enable-fips-checks +