Extend Amazon Inspector SBOM Generator with Plugins

This article announces a new plugin system for Amazon Inspector SBOM Generator, enabling users to create custom package collectors for unsupported software ecosystems.

• Write plugins in Lua without compilation; load at runtime for immediate testing and iteration
• Plugin system uses discovery and collection pipeline with event bus for efficient artifact scanning
• Scaffolding tool creates complete plugin workspace with tests, documentation, and IDE support in seconds
• Plugins run in isolated sandbox with restricted Lua standard library for security and stability
• Plugin-generated components integrate with Amazon Inspector for vulnerability scanning
• Over 30 ecosystems now implemented as plugins including Tomcat, NGINX, Conda, and Swift packages
• Built-in test framework and VS Code integration enable rapid development without Go toolchain

The plugin system enables security teams to quickly extend SBOM coverage for new or proprietary package managers while maintaining a secure, stable foundation.