AWS inspector: Document CIS Docker Benchmark namespace fields in SBOM
Summary
Adds two CycloneDX namespace entries for the Amazon Inspector SBOM Generator recording CIS Docker Benchmark check results (pass/fail) and an aggregate checks_passed boolean, gated behind the experimental --enable-cis-docker argument.
Security assessment
The added lines document SBOM namespace fields that surface CIS Docker Benchmark hardening check results, which is security-relevant compliance documentation but not tied to a specific vulnerability or CVE.
Evidence
+`amazon:inspector:sbom_generator:image:cis:docker:`check`` | The `pass` or `fail` result of a supported CIS Docker Benchmark check (4.1, 4.6, 4.7, 4.9, or 4.10). Recorded only when the experimental `--enable-cis-docker` argument is used. For more information, see [Evaluate CIS Docker Benchmark checks](https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html#sbomgen-using-cis-docker).
Diff
diff --git a/inspector/latest/user/cyclonedx-namespace.md b/inspector/latest/user/cyclonedx-namespace.md index b8fff10..0f1c61f 100644 --- a//inspector/latest/user/cyclonedx-namespace.md +++ b//inspector/latest/user/cyclonedx-namespace.md @@ -53,0 +54,2 @@ The Amazon Inspector SBOM Generator uses the `amazon:inspector:sbom_generator` n +`amazon:inspector:sbom_generator:image:cis:docker:`check`` | The `pass` or `fail` result of a supported CIS Docker Benchmark check (4.1, 4.6, 4.7, 4.9, or 4.10). Recorded only when the experimental `--enable-cis-docker` argument is used. For more information, see [Evaluate CIS Docker Benchmark checks](https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html#sbomgen-using-cis-docker). +`amazon:inspector:sbom_generator:image:cis:docker:checks_passed` | A boolean value indicating whether every supported CIS Docker Benchmark check passed. Recorded only when the experimental `--enable-cis-docker` argument is used.