JA EN
shiichan

See your whole software footprint at a glance! AWS Security Hub adds an SBOM inventory

AWS What's New ★★★★ View Markdown
#aws#security

Hi everyone, it's Shii-chan! Today's announcement is good news for security teams.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Security Hub now provides a Software Bill of Materials (SBOM) inventory: a continuously updated, organization-wide view of the software packages and applications installed on your compute resources.

Why it matters

When a vulnerability appears, being able to answer "where is that package?" quickly is key to security operations. Now you can see it in one place.

What changes

  • Central security teams get an organization-wide package list
  • During triage, the resource detail page shows what is installed, so you can judge its function and criticality
  • You can also query the inventory through the Security Hub API

Dive Deep

The inventory is built from SBOMs that Amazon Inspector generates for:

  • Amazon EC2 instances
  • Amazon ECR container images
  • AWS Lambda functions

What you can do:

  • The SBOM page lists each package with its version, type, and number of resources where it is installed
  • Filter and group by package attributes, account, and Region
  • The Installed software tab on a resource detail page lists every package on that resource

Pricing and availability:

  • Included with Security Hub Essentials at no additional cost
  • No new enablement; it populates automatically where Amazon Inspector is enabled
  • Available in all AWS Regions where Security Hub is available

Wrap-up

  • Organization-wide package inventory built from Inspector SBOMs
  • Covers EC2, ECR, and Lambda, and is queryable via API
  • No extra cost or configuration

This is for security folks who want faster vulnerability response with SBOMs!

Related posts