How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄
Tags: aws, inspector, s3, eventbridgescheduler
Published: 2023-09-01 15:26:12

---
title: How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄
published: true
date: 2023-08-31 20:28:00 UTC
tags: AWS,Inspector,S3,EventBridgeScheduler
canonical_url: https://alexanderhose.com/how-to-use-aws-inspector-and-lambda-to-create-scheduled-sboms/
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/br5l3rkgnjc3n1fmr8ng.png
---

## Do you want to keep your AWS workloads secure? 🔐

If so, you need to know what **software components** are running on your workloads. This is where software bills of materials (SBOMs) come in. **SBOMs** are a comprehensive list of the software components used in a software application. They can be used to track the **provenance** of software, identify **security vulnerabilities** , and comply with **security regulations**.

In this blog article, we will explore how to use **Amazon Inspector** and **Lambda** to create **scheduled SBOMs**. This will allow you to generate SBOMs for your workloads regularly. Afterward, you can incorporate **analytics 📊** and **alerting ⏰**.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2lgox5fyffr3vjnefa10.png)

## Prerequisites 🏗️

Ensure you have the Inspector agent installed on all workloads, which are in scope for SBOM creation. 

## Create KMS key 🔑

First, you need to create a new KMS key and allow Inspector to use it. Inspector will use this key to encrypt the data. Make sure you create a customer-managed key.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-23.png)

```json
{
   "Sid":"Allow Amazon Inspector",
   "Effect":"Allow",
   "Principal":{
      "Service":"inspector2.<region>.amazonaws.com"
   },
   "Action":[
      "kms:Decrypt",
      "kms:GenerateDataKey*"
   ],
   "Resource":"*",
   "Condition":{
      "StringEquals":{
         "aws:SourceAccount":"<accountID>"
      },
      "ArnLike":{
         "aws:SourceArn":"arn:aws:inspector2:<region>:<accountID>:report/*"
      }
   }
}
```

You only need to add the region of the principal if you are using a manually activated Inspector. Otherwise, you can use _inspector2.amazonaws.com_

## Create S3 Bucket and adjust bucket policy 🗄️

You want to store your SBOM in a S3 bucket. To do this, you need to create a new bucket and adjust the bucket policy. In the newly created bucket, you need to go to permissions and then click on edit bucket policy. Make sure the `allow-inspector` section is available in the policy and adjust it based on your settings.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-24.png)

```json
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ForceSSLOnlyAccess",
			"Effect": "Deny",
			"Principal": {
				"AWS": "*"
			},
			"Action": "s3:*",
			"Resource": [
				"arn:aws:s3:::<bucketName>",
				"arn:aws:s3:::<bucketName>/*"
			],
			"Condition": {
				"Bool": {
					"aws:SecureTransport": "false"
				}
			}
		},
		{
			"Sid": "allow-inspector",
			"Effect": "Allow",
			"Principal": {
				"Service": "inspector2.<region>.amazonaws.com"
			},
			"Action": [
				"s3:PutObject",
				"s3:PutObjectAcl",
				"s3:AbortMultipartUpload"
			],
			"Resource": "arn:aws:s3:::<bucketName>/*",
			"Condition": {
				"StringEquals": {
					"aws:SourceAccount": "<accountID>"
				},
				"ArnLike": {
					"aws:SourceArn": "arn:aws:inspector2:<region>:<accountID>:report/*"
				}
			}
		}
	]
}
```

You also only need to add the region to the principal if you are using a manually activated Inspector. Otherwise, you can use _inspector2.amazonaws.com_

## Create Lambda function ⚡️

Now we have covered the prerequisites and can move to the fun part. Let's develop the Lambda function. You need to create a new Python function and add the following code:

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-21.png)

```python
import json
import boto3
client = boto3.client('inspector2')

def lambda_handler(event, context):
    response = client.create_sbom_export(
        reportFormat='CYCLONEDX_1_4',
        resourceFilterCriteria={
            'ec2InstanceTags': [
                {
                    'comparison': 'EQUALS',
                    'key': 'Criticality',
                    'value': event['Criticality']
                },
            ]
        },
        s3Destination={
            'bucketName': '<bucketName>',
            'kmsKeyArn': 'arn:aws:km:<region>:<accountID>:key/<keyID>'
        }
    )
    
    return {
        'statusCode': 200,
        'body': json.dumps(response)
    }
```

We are first choosing the `reportFormat`. This can be either `CYCLONEDX_1_4` or `SPDX_2_3`. To filter certain instances, we will check the `Criticality` tag of the instances. Later we can create different schedules for the criticality of the asset. In the last step, we define our `s3Destination` and need to choose the KMS key we created earlier.

In the permission configuration of your Lambda role, ensure that you allow the `inspector2:CreateSbomExport` action:

```json
{
   "Sid":"Allow Lambda to create SBOM",
   "Effect":"Allow",
   "Action":[
      "inspector2:CreateSbomExport"
   ],
   "Resource":[
      "*"
   ]
}
```

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-22.png)

## Configure Amazon EventBridge Scheduler 🔄

Amazon EventBridge Scheduler is a serverless scheduler that allows you to create, run, and manage tasks from one central, managed service. It is a great way to automate tasks that need to be performed regularly.

To use Amazon EventBridge Scheduler, you first need to create a schedule. A schedule defines the time and frequency at which a task should be run. In your case, I would recommend for example every 7 days.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-15.png)

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-16.png)

You can also specify a target for the task. Here you need to choose Lambda and choose your function.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-17.png)

During the invocation of the function, you can also configure a payload. In the Lambda function, we are checking the variable `event['Criticality']` which you can define here. Now we can create different schedulers for the different criticality levels of our assets. You could for example check all critical assets daily and non-critical ones every week.

![How to Use AWS Inspector and Lambda to Create Scheduled SBOMs 📄](https://alexanderhose.com/content/images/2023/08/image-18.png)

You will now regularly get your SBOM export in the configured S3 bucket 🎉

## The Advantages of Scheduled SBOMs 💡

Embracing the synergy of **Inspector** and **Lambda** to create Scheduled SBOMs presents benefits to your cybersecurity strategy:

- **Continuous Compliance:** By automating the SBOM generation process, you ensure consistent compliance with security best practices.
- **Resource Efficiency:** AWS Lambda's serverless architecture ensures efficient utilization of resources, optimizing costs while maintaining security standards.
- **Analytics:** You can analyze your SBOM exports and create compliance dashboards with Amazon QuickSight or Amazon Athena.

## In Conclusion 🎓

Inspector and Lambda provide an innovative, automated solution to enhance your defense against potential vulnerabilities. By following the steps outlined in this guide, you'll be on your way to creating scheduled SBOMs that bring visibility to your application ecosystem. Take charge of your cybersecurity journey today and ensure your digital assets remain secure tomorrow. 🔐