From the AWS edition of November 7, 2026
AWS Security Hub adds organization-wide SBOM inventory from Amazon Inspector for EC2, ECR and Lambda, available wherever Security Hub runs (including GovCloud)
Amazon Web Services · Cloud security / software supply chain · All AWS Regions where Security Hub is available (Security Hub is in GovCloud US-East and US-West)
- Publisher
- AWS What's New
- Original publication
- 2026-11-06
- Source retrieved
- 2026-11-08
- Event date
- 2026-11-06
What happened
AWS says Security Hub now provides a Software Bill of Materials inventory giving central security teams an organization-wide view of software packages installed on compute resources. It is built from SBOMs that Amazon Inspector generates for EC2 instances, ECR container images and Lambda functions, lists each package with version, type and number of resources, supports filtering by account and Region, shows installed software per resource during triage, and is queryable by API. It is included with Security Hub Essentials at no additional cost, needs no new enablement, populates where Inspector is enabled, and is available in all Regions where Security Hub is available. A separate March 30, 2026 What's New confirms Security Hub availability in GovCloud (US-East and US-West). The announcement does not mention AI workloads; the AI link here is interpretation.
Why it matters
SLED teams running Bedrock AgentCore or other AI agent code in Lambda or ECR containers could use the inventory to find outdated AI SDK packages (for example bedrock-agentcore versions affected by prior AWS bulletins) across accounts, including GovCloud.
Evidence and measured results
Primary AWS announcement (vendor claim) plus AWS What's New confirming Security Hub GovCloud availability. No independent validation of coverage or accuracy.
Limitations and uncertainty
Vendor claim; AI relevance is interpretation; coverage of AgentCore-managed runtimes not stated; Inspector must be enabled; GovCloud availability inferred from Security Hub's GovCloud availability plus 'all Regions' statement.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Security teams cannot easily see which AI agent workloads run outdated SDK packages across many accounts.
- Stakeholders
- CISO / central security
- Cloud platform team
- AI application owners
- Discovery questions
- Is Inspector enabled organization-wide, including GovCloud?
- Where does agent code run: Lambda, ECR, AgentCore Runtime?
- What minimum SDK versions are policy?
- Value hypothesis
- A no-added-cost inventory may shorten time to find vulnerable AI packages; remediation speed is not shown.
- Potential engagement
- Short AI-package inventory and remediation hand-off using existing Security Hub and Inspector.
- Unsupported claims
- Coverage of AgentCore-managed runtimes
- Automatic remediation
- Measured risk reduction
Pre-sales engineering
Role takeaway
- Fit
- Good fit for Lambda/ECR-hosted AI code with Inspector; unknown for AgentCore-managed microVMs.
- Architecture and integration
- Enable Inspector and Security Hub org-wide; query SBOM inventory by package/version via console or API.
- Prerequisites
- Inspector enabled
- Security Hub Essentials
- Workload tagging
- Constraints
- Inspector resource types only
- Regional availability follows Security Hub
- AI link is interpretation
- Security
- Visibility control only; pair with patch SLAs and least privilege.
- Proof of value
- bedrock-agentcore versions listed per resource
- Inventory matches manual sample check
Delivery
Role takeaway
- Work
- Inventory AI-related packages and establish remediation workflow.
- Dependencies
- Inspector
- Security Hub delegated admin
- Workload owners
- Ownership
- Central security team; application teams patch.
- Skills and adoption
- SBOM interpretation and vulnerability triage.
- Governance checkpoints
- Minimum SDK version policy
- Remediation SLA sign-off
- Acceptance criteria
- Proposed: all Inspector-covered AI workloads in inventory
- Proposed: no package below minimum after SLA
- Risks
- Coverage blind spots
- Inventory mistaken for remediation
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Requires Amazon Inspector scanning of EC2, ECR and Lambda; Security Hub aggregates SBOMs organization-wide. AgentCore Runtime microVM contents are not stated as covered.
Governance
Who approves, reviews and stays accountable for outcomes?
Supports software-inventory controls and patch-verification evidence; agencies still define remediation SLAs.
Security and privacy
What data, permissions and controls need testing?
Improves visibility into vulnerable packages; does not itself patch or block. Coverage limited to Inspector-supported resource types.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
None reported.
Procurement
What should contracts, pricing and exit terms secure?
No additional cost beyond Security Hub Essentials per AWS; Inspector charges still apply.
Operating model
Which teams own the service once it runs?
Central security teams gain a single package view; application teams remain responsible for upgrades.
Publication history
- 2026-11-07AWS · Issue 107 resources
Stable resource ID: aws-security-hub-sbom-inventory-20261106