# Automated SBOM Generation and Security Scanning with Amazon Inspector in AWS CI/CD Pipeline Created on 2025-03-26 13:05 Published on 2025-03-26 15:45 Hello everyone, I hope you all are doing well. In this week's blog, we will understand how to generate SBOM and perfom security scanning with Amazon Inspector in AWS CI/CD Pipeline. Let's get started. ### What is an SBOM? **Software Bill of Materials (SBOM)** is a inventory of software components, libraries, and dependencies that we use use in our application. It helps track open-source and third-party components, ensuring compliance. ### Why Use Amazon Inspector? * **Automated SBOM Generation** – Inspector scans container images and generates an SBOM in **CycloneDX** or **SPDX** format. * **Vulnerability Assessment** – Continuously scans for **CVE** vulnerabilities in dependencies. Let's start with the hands-on step by step for the AWS Console - 1. Let's first enable the Inspector Scanning for ECR Repositories. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245333042/271f01a9-b456-45ed-81ff-0182ca8cdecc.png align="left") 2. Let's create a vulnerable python sample application and create a Dockerfile for this blog and push it to a Github Repo. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245334173/406f0e8b-bafc-4321-9f8a-d3b6dd25a15d.png align="left") Creating a vulnerable python app ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245335218/79e72e2e-cfae-4c30-958b-68a39ecedcb9.png align="left") requirements.txt file ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245336111/ffa5ab77-9517-4a6b-b514-bd930abb6b1f.png align="left") Dockerfile ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245336970/7724034a-3e97-4761-b8d2-ec857d175ed9.png align="left") 3. Let's create a ECR repository for the app. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245337885/0e590ae4-884b-449f-8992-6d9158cab185.png align="left") 4. Now, we will create a S3 bucket where will store are scan report and SBOM Report. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245339013/39c32ba7-7c43-4165-b41d-98349e86cfea.png align="left") 5. Create a buildspec.yml file for your codebuild project in your github repo. First we specifiy the version. Then we define your environment variables - AWS Region, ECR Repo Name and S3 Bucket Name, and KMS Key ARN(Ideally this can also be generate and used). Define the phases - first is install, where we are updating all installed packages to the latest version. Also, installing jq. After that we are exporting some variables for further use. * : Shortened commit hash of the current Git revision. * : Timestamp in format for versioning. * : Semantic versioning using Git tags * : Combines versioning information to tag the Docker image. * : Fetches the AWS account ID using . * : Creates the URI for the ECR repository. * : Defines a unique S3 path using the timestamp and commit hash. After that we will login into our ECR Repo using aws ecr get-login-password --region $​{AWS\_REGION} | docker login --username AWS --password-stdin $ACCOUNT\_ID.dkr.ecr.$AWS\_[REGION.amazonaws.com/python-app](http://REGION.amazonaws.com/python-app) Next step is to build the docker image and push it to ECR repo. Continuous security scan occurs. Also, we generate SBOM scan report and push it to S3 bucket. If we find any critical or high severity vulnerability we will fail the build process. Push the buildspec.yml file to root of your GitHub Repositiory. Below is the buildspec.yml file that I created - 6. Let's create a AWS Codebuild project now. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245340040/c0a6aa83-1d8c-45eb-ae6f-a628afedcf83.jpeg align="left") Creating a build project in Codebuild ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245341071/16bf33bd-3e57-4d39-b274-3f69cbe02f2f.jpeg align="left") Creating a connection with GitHub ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245342061/2abd2f98-5f24-4742-984d-81f964637f17.jpeg align="left") Define the source ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245343144/d2d08546-5d8e-449b-9ca9-ca07f1513ef9.jpeg align="left") webhook ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245344233/59e5263a-e709-4a9f-aceb-169ea3beb96d.jpeg align="left") Define the environment for build. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245345372/881952ad-5417-4897-bb5f-db5281e9663f.jpeg align="left") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245346428/688556c2-5967-48ca-a27a-9118080c6b34.jpeg align="left") Select option for buildspec.yml file. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245347391/0cabfd9c-4d39-44be-8d98-d2de6ef61a85.jpeg align="left") We have successfully created a build project. Provide appropriate permissions to the service role. I have provide full access to a some service for a demo purpose. But if you are enviroment is a prod, follow principle of least privilege. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245348357/ee756584-1321-4f1e-87f3-a55d61371626.png align="left") 7. Let's now create a AWS Codepipeline. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245349640/4040e483-1412-4601-8d27-19abf51bab72.jpeg align="left") We will choose a creation option ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245350783/5437a15b-af57-463f-a2e8-8dea8ae95742.jpeg align="left") Choose the source ie. we will choose github, repository name and branch ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245352005/691b358b-5a8d-421f-ae81-0bc7a94e00bd.jpeg align="left") Configure S3 bucket where we will store our artifacts ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245353174/402556b2-b92a-4942-ab2f-c719feddec68.jpeg align="left") Review the pipeline configuration ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245354372/2d87f3bc-bfd4-4fb7-9e4a-e6ddd02df3d2.jpeg align="left") Successfully created the pipeline. 8. Let's push a change to our GitHub repo, it will automatically trigger this pipeline. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245355558/107bb05d-6e50-47c5-b255-e86d39fb7363.png align="left") 9. Let's wait for the pipeline to execute. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245356507/8893b2ad-7c1f-4bda-a94d-3723390a0424.png align="left") We can see the build has failed. 10. We can see the build has failed. This is because it should have found the high and critical vulnerabilities. This is what we configured in the buildspec.yml file. Let's check. Due to the high number of lines of logs, the codebuild webpage is not responding, not sure, why this is happening. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245357555/c7ce3dd0-baf4-4729-be4b-780ec3f398c8.png align="left") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245358548/9904a262-7237-4859-8fdf-f8e97336c985.png align="left") Let's see the logs in cloudwatch - ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245359509/37f84909-a1a1-49e3-9dc0-ec3119adb1b7.png align="left") We can see that Codebuild is running On-demand ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245360578/8a080918-f587-4eb5-89dd-e3d800150c5b.png align="left") updates the packages to latest versions and installs jq ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245361760/1f428b9b-b1ea-4938-b1af-5ccfe2bac5a0.png align="left") Exports the variable and does docker login for ECR ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245362961/548f448d-1a57-4b18-af46-9009a584c2be.png align="left") Docker Image creation in progress ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245363955/8c114caf-675e-4374-8005-314cba6b91bd.png align="left") Docker Image creation in progress ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245365132/8e154b8c-ade9-48c3-a6fb-98d0a9126c1b.png align="left") Docker Image creation in progress ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245366171/d68a1692-b4ab-4fd5-93b4-b6738377e967.png align="left") Docker Image creation in progress ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245367237/c6f09b42-10c5-4c70-9fa3-5424f1df716e.png align="left") Pushing to ECR Repo ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245368322/eff9bff9-414d-49fd-b379-3c9e14336249.png align="left") Generating SBOM Report and then checking for high and critical vulnerabiltiies in security vulnerabilities. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245369601/f0f57807-228e-4332-bf85-a62a860c9da8.png align="left") SBOM report pushed to s3 bucket in CYCLONEDX Format as we mentioned. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245371083/099f44f4-14da-49f5-8a26-691241de2ddc.png align="left") Generated report - a finding whoe CVSS Score is 8.8 ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245372173/de73b929-19af-4365-bd0c-30fa8d1c9b75.png align="left") Generated report - a finding whoe CVSS Score is 7.5 Similarly there are many other critical and high severity findings. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245373282/7fec2111-d1bc-422a-ba47-dd63f9db58ff.png align="left") Some of the findings Hence, we explored how we can seamlessly integrate **Amazon Inspector** into your AWS CI/CD pipeline to generate **Software Bill of Materials (SBOM)** and perform comprehensive security scans. Key takeaways include: * Efficiently building and pushing Docker images to **Amazon ECR**. * Using **Amazon Inspector** to generate SBOM reports in **CycloneDX** format. * Implementing a check ie security gate to block deployments if critical or high-severity vulnerabilities are identified. * Storing findings securely in **Amazon S3** with **KMS encryption** for compliance and audit purposes. Next steps: deploy this pipeline using Terraform! That's all in this blog, see you next week. Regards Sankalp Sandeep Paranjpe [https://www.linkedin.com/in/sankalp-s-paranjpe/](https://www.linkedin.com/in/sankalp-s-paranjpe/)