AWS inspector: Document CIS Docker Benchmark checks evaluated by sbomgen
Summary
Expands the --enable-cis-docker documentation with the specific checks evaluated (non-root user, HEALTHCHECK, package-manager update/install, no ADD, no secrets in ARG/ENV/RUN) and clarifies checks_passed is now a boolean.
Security assessment
Documents container image hardening checks including detection of embedded secrets and non-root user configuration; this is security best-practice documentation, not a fix for a specific vulnerability.
Evidence
+ * `4.10` – No supported secret pattern is present in an `ARG`, `ENV`, or `RUN` instruction in the build history, or in the image's final environment variables.
Diff
diff --git a/inspector/latest/user/sbom-generator.md b/inspector/latest/user/sbom-generator.md index 53b0ecc..e01aab7 100644 --- a//inspector/latest/user/sbom-generator.md +++ b//inspector/latest/user/sbom-generator.md @@ -451 +451 @@ The following example shows how to use the `--collect-processes` argument. -When you scan a container image, you can use the `--enable-cis-docker` argument to evaluate supported CIS Docker Benchmark checks and record the result of each check as a property on the container component. +When you scan a container image, you can use the `--enable-cis-docker` argument to evaluate supported CIS Docker Benchmark checks and record the result of each check as a property on the container component. Sbomgen evaluates the checks from the image configuration and build history. @@ -456,0 +457,15 @@ This argument is experimental, applies to container scans only, and is disabled +Sbomgen evaluates the following checks: + + * `4.1` – The image is configured with a non-root user. + + * `4.6` – The image is configured with an enabled `HEALTHCHECK`. + + * `4.7` – Every package-manager update command is followed by an install command in the same `RUN` instruction. + + * `4.9` – The build history doesn't contain an `ADD` instruction. + + * `4.10` – No supported secret pattern is present in an `ARG`, `ENV`, or `RUN` instruction in the build history, or in the image's final environment variables. + + + + @@ -461 +476 @@ Sbomgen records the following properties on the container component, where `chec - * `amazon:inspector:sbom_generator:image:cis:docker:checks_passed` – The number of evaluated checks that passed. + * `amazon:inspector:sbom_generator:image:cis:docker:checks_passed` – `true` if every supported check passed, or `false` if any check failed.