{"resourceId":"aws-security-hub-sbom-inventory-20261106","versions":[{"version":"external-dde4b26de0b38b4b7856127040bdc8b38b069a9a3be83e495bb299ee7f755e8b","resource":{"id":"aws-security-hub-sbom-inventory-20261106","title":"AWS Security Hub adds organization-wide SBOM inventory from Amazon Inspector for EC2, ECR and Lambda, available wherever Security Hub runs (including GovCloud)","organization":"Amazon Web Services","sector":"Cloud security / software supply chain","geography":"All AWS Regions where Security Hub is available (Security Hub is in GovCloud US-East and US-West)","publishedAt":"2026-11-06","publicationDate":"2026-11-06","eventDate":"2026-11-06","sourceName":"AWS What's New","sourceLabel":"AWS Security Hub now provides an SBOM inventory for your compute resources","sourceUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/security-hub-sbom-inventory/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","developers-agents","infrastructure"],"finding":"AWS says Security Hub now provides a Software Bill of Materials inventory giving central security teams an organization-wide view of software packages installed on compute resources. It is built from SBOMs that Amazon Inspector generates for EC2 instances, ECR container images and Lambda functions, lists each package with version, type and number of resources, supports filtering by account and Region, shows installed software per resource during triage, and is queryable by API. It is included with Security Hub Essentials at no additional cost, needs no new enablement, populates where Inspector is enabled, and is available in all Regions where Security Hub is available. A separate March 30, 2026 What's New confirms Security Hub availability in GovCloud (US-East and US-West). The announcement does not mention AI workloads; the AI link here is interpretation.","sledRelevance":"Interpretation: SLED teams running Bedrock AgentCore or other AI agent code in Lambda or ECR containers could use the inventory to find outdated AI SDK packages (for example bedrock-agentcore versions affected by prior AWS bulletins) across accounts, including GovCloud.","evidence":"Primary AWS announcement (vendor claim) plus AWS What's New confirming Security Hub GovCloud availability. No independent validation of coverage or accuracy.","architectureImplications":"Requires Amazon Inspector scanning of EC2, ECR and Lambda; Security Hub aggregates SBOMs organization-wide. AgentCore Runtime microVM contents are not stated as covered.","governanceImplications":"Supports software-inventory controls and patch-verification evidence; agencies still define remediation SLAs.","securityPrivacyImplications":"Improves visibility into vulnerable packages; does not itself patch or block. Coverage limited to Inspector-supported resource types.","caveats":"Vendor claim; AI relevance is interpretation; coverage of AgentCore-managed runtimes not stated; Inspector must be enabled; GovCloud availability inferred from Security Hub's GovCloud availability plus 'all Regions' statement.","streamIds":["aws"],"roles":{"sales":"Position this as a low-friction control for public-sector teams already using Security Hub and Inspector, including in GovCloud: one inventory to answer which accounts still run outdated AI SDK packages. Discovery should confirm Inspector coverage and where agent code actually runs. Do not claim it covers AgentCore-managed runtimes or replaces patching. A bounded engagement is a short inventory exercise to locate AI-related packages, such as bedrock-agentcore, across Lambda and container images, then hand off a remediation list.","engineering":"Fit is strongest where AI agent code is packaged in Lambda functions or ECR images scanned by Inspector. Integration is automatic once Security Hub and Inspector are enabled; query by package name and version through the console or API. Prerequisites are organization-wide Inspector, Security Hub Essentials and consistent tagging of AI workloads. Constraints: AgentCore-managed microVM coverage is not stated, and GovCloud availability follows Security Hub's Regional list. Proof of value: inventory lists bedrock-agentcore versions per resource, matching a manual check on sample functions.","delivery":"Run a one-time AI package inventory, then fold it into routine vulnerability management. Dependencies are Inspector enablement, Security Hub delegated admin and workload owners for remediation. Ownership sits with the central security team, with application teams patching. Governance checkpoints include defining which AI SDK versions are acceptable and remediation SLAs. Acceptance criteria, as proposals: every Inspector-covered AI workload appears in inventory; no package below agreed minimum versions after SLA. Risks are blind spots outside Inspector coverage and treating inventory as remediation."},"roleDetails":{"sales":{"customerProblem":"Security teams cannot easily see which AI agent workloads run outdated SDK packages across many accounts.","stakeholders":["CISO / central security","Cloud platform team","AI application owners"],"discoveryQuestions":["Is Inspector enabled organization-wide, including GovCloud?","Where does agent code run: Lambda, ECR, AgentCore Runtime?","What minimum SDK versions are policy?"],"valueHypothesis":"A no-added-cost inventory may shorten time to find vulnerable AI packages; remediation speed is not shown.","potentialEngagement":"Short AI-package inventory and remediation hand-off using existing Security Hub and Inspector.","unsupportedClaims":["Coverage of AgentCore-managed runtimes","Automatic remediation","Measured risk reduction"]},"engineering":{"fit":"Good fit for Lambda/ECR-hosted AI code with Inspector; unknown for AgentCore-managed microVMs.","architectureIntegration":"Enable Inspector and Security Hub org-wide; query SBOM inventory by package/version via console or API.","prerequisites":["Inspector enabled","Security Hub Essentials","Workload tagging"],"constraints":["Inspector resource types only","Regional availability follows Security Hub","AI link is interpretation"],"security":"Visibility control only; pair with patch SLAs and least privilege.","proofOfValue":["bedrock-agentcore versions listed per resource","Inventory matches manual sample check"]},"delivery":{"work":"Inventory AI-related packages and establish remediation workflow.","dependencies":["Inspector","Security Hub delegated admin","Workload owners"],"ownership":"Central security team; application teams patch.","skillsAdoption":"SBOM interpretation and vulnerability triage.","governanceCheckpoints":["Minimum SDK version policy","Remediation SLA sign-off"],"acceptanceCriteria":["Proposed: all Inspector-covered AI workloads in inventory","Proposed: no package below minimum after SLA"],"risks":["Coverage blind spots","Inventory mistaken for remediation"]}},"retrievedAt":"2026-11-08T04:04:27Z","enrichedAt":"2026-11-08T04:11:17Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"None reported.","procurementImplications":"No additional cost beyond Security Hub Essentials per AWS; Inspector charges still apply.","operatingModelImplications":"Central security teams gain a single package view; application teams remain responsible for upgrades.","sourceVerification":{"openedUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/security-hub-sbom-inventory/","referenceExcerpt":"It requires no new enablement and populates automatically where Amazon Inspector is enabled.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}