
Using Software Bill of Materials (SBOM) with AWS services like Amazon ECR, EventBridge, CodeBuild, and Athena enables organizations to automatically identify vulnerable software components in container images running on Amazon EKS clusters.


<div><p>This article explains how to use Software Bill of Materials (SBOM) to identify vulnerable container images running on Amazon EKS clusters.</p><ul><li>SBOM provides machine-readable inventory of all software components in container images</li><li>96% of commercial codebases contain open source; 48% have high-risk vulnerabilities</li><li>Solution uses Syft to generate SBOM files in SPDX JSON format</li><li>AWS CodeBuild pipeline automatically generates SBOM when images pushed to ECR</li><li>CronJob discovers all pods running in EKS cluster and lists container images</li><li>AWS Glue Crawler indexes SBOM and image data for querying</li><li>Amazon Athena SQL queries identify vulnerable packages in running containers</li><li>Solution includes one-off scan for existing ECR images without SBOM</li></ul><p>This approach enables organizations to quickly identify which container images contain specific vulnerable packages or versions, critical for responding to zero-day vulnerabilities like Log4Shell.</p></div>


Related articles