Using the Amazon Inspector Jenkins plugin

1. From the Jenkins dashboard, choose Manage Jenkins, and then choose Plugins.

2. Choose Available plugins.

3. Search for Amazon Inspector Scanner, select it, and then choose Install.

1. From the Jenkins dashboard, choose Manage Jenkins, Credentials, and then System.

2. Choose Global, and then choose Add Credentials.

3. Select Username with password, and then choose Next.

4. For Scope, select Global (Jenkins, nodes, items, all child items, etc).

5. Enter the user name and password for your registry, and then choose Create. If your registry supports access tokens, we recommend that you use a read-only token as the password instead of your account password.

To add an access key

1. From the Jenkins dashboard, choose Manage Jenkins, Credentials, and then System.

2. Choose Global, and then choose Add Credentials.

3. Select AWS Credentials, and then choose Next.

4. Enter your Access Key ID and Secret Access Key, and then choose Create.

To add an OIDC credential

1. From the Jenkins dashboard, choose Manage Jenkins, Credentials, and then System.

2. Choose Global, and then choose Add Credentials.

3. Select OpenID Connect id token, and then choose Next.

4. For Audience, enter sts.amazonaws.com, and then choose Create. To see the issuer URI of the credential, open it and choose Update credential.

5. In IAM, create an OIDC identity provider with the issuer URI as the provider URL and sts.amazonaws.com as the audience. For more information, see Create an OpenID Connect (OIDC) identity provider in IAM.

6. Add a statement to the trust policy of the role that you created in Step 1 that allows the provider to call sts:AssumeRoleWithWebIdentity. Include a condition on the provider's aud key with the value sts.amazonaws.com. To allow only specific jobs to assume the role, also add a condition on the sub key, which contains the URL of the job by default. The following example statement allows only the job my-job on a Jenkins controller at jenkins.example.com to assume the role.

   {
       "Effect": "Allow",
       "Principal": {
           "Federated": "arn:aws:iam::111122223333:oidc-provider/jenkins.example.com/oidc"
       },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
           "StringEquals": {
               "jenkins.example.com/oidc:aud": "sts.amazonaws.com",
               "jenkins.example.com/oidc:sub": "https://jenkins.example.com/job/my-job/"
           }
       }
   }

1. On the configuration page of your project, under Build Steps, choose Add build step, and then choose Amazon Inspector Scan.

2. For Inspector-sbomgen Installation Method, choose one of the following:

   • Automatic – The plugin downloads the latest version of the Amazon Inspector SBOM Generator at the start of each build. The Jenkins controller must run Linux and be able to reach amazon-inspector-sbomgen.s3.amazonaws.com over HTTPS.

   • Manual – Enter the full path to an inspector-sbomgen binary that you downloaded, such as /opt/inspector/inspector-sbomgen. Choose this option to use a specific version of the Amazon Inspector SBOM Generator, or if the Jenkins controller can't download it. The plugin checks the path on the Jenkins controller, but runs the binary on the machine that runs the build. If these are different machines, put the binary at the same path on both. For download links, see Installing Sbomgen.

3. For Image ID, enter the image to scan. The image can be local, remote, or archived, and its name must follow the Docker naming convention:

   • For a local or remote image: NAME[:TAG|@DIGEST]

   • For an image exported to a tar file: /path/to/image.tar

4. (Optional) For Report Artifact Name, enter a prefix for the file name of the SBOM that the build archives. The default is default-report. The name can contain up to 255 letters, numbers, periods (.), underscores (_), and hyphens (-).

5. (Optional) For Skip Files, enter the files and directories to exclude from the scan, one per line or separated by commas without spaces. Consider this option for large directories that don't need to be scanned.

6. (Optional) For Docker Credentials, choose the credentials that you added in Step 3.

7. For AWS Region, choose the Region to send the scan request to.

8. Under AWS Authentication Options (Choose One), configure one of the following options. If you leave all of them empty, the plugin uses the default credential provider chain on the Jenkins controller.

   • For IAM Role, enter the Amazon Resource Name (ARN) of the role that you created in Step 1, such as arn:aws:iam::111122223333:role/InspectorCICDscan-role. To assume the role with OIDC, also choose the credential that you added in Step 4 for OIDC Credentials.

   • For AWS Credentials, choose the access key that you added in Step 4.

   • For AWS Profile Name, enter the name of a profile on the Jenkins controller.

   If you configure more than one option, the plugin uses the first one in this order: AWS Credentials, IAM Role with OIDC Credentials, IAM Role, and then AWS Profile Name.

9. (Optional) Under Scan Output Filters, choose the checks that can fail the build. For a description of each option, see Scan output filters.

10. Choose Save.

1. Run a build of your project.

2. Open the build. When the scan completes, the console output ends with a security assessment summary and whether the build passed.

3. Under Build Artifacts, choose index.html to open the HTML report. The build also archives the following files:

   • The SBOM that the Amazon Inspector SBOM Generator created, in JSON format.

   • A CSV file with the vulnerability findings, if the scan found any.

   • A CSV file with the Dockerfile findings, if the scan found any.

   The report shows the scanned image, the number of findings for each severity, and a table that lists each vulnerability with its ID, severity, and affected package. The following image shows an example report.

1. Download the Amazon Inspector SBOM Generator for the CPU architecture of the machine that runs the build. For more information, see Installing Sbomgen.

2. Make the binary executable by running the following command: chmod +x inspector-sbomgen.

3. In the build step, enter the full path to the binary, such as /opt/inspector/inspector-sbomgen. The plugin checks the path on the Jenkins controller, so if the build runs on an agent, the binary must be at the same path on both.

4. Save the configuration, and run the build again.