AWS Security Hub adds an organisation-wide SBOM inventory built from Amazon Inspector data
Serguey Asael Shinder1 min readOn 6 November AWS added a software bill of materials view to AWS Security Hub. It is meant to give a central security team one list, kept current across the whole organisation, of the packages and applications present on its compute.
The data is not collected anew. Amazon Inspector already produces SBOMs for EC2 instances, container images in ECR and Lambda functions, and Security Hub assembles them into the inventory without extra setup. For every package the page shows its version and type and counts how many resources carry it; the view can be sliced by package attributes, by account and by region. Each resource also gets an Installed software tab listing everything on it, which AWS presents as context when deciding how important a resource is while working through a finding. The same data is available through the Security Hub API.
The feature is included with Security Hub Essentials at no additional cost. It requires no new enablement and fills itself wherever Amazon Inspector is enabled, so accounts without Inspector get an empty page. It is available in all AWS Regions where Security Hub is available.
What it means
The question after every new library vulnerability is where the package runs. An inventory keyed by package and counted by resource answers that across accounts in one query, provided Inspector is switched on everywhere it needs to be.