Add Amazon Inspector as an automated source.

[calebbrown]

This is a tracking bug to add support for ingesting Amazon Instpector directly from an S3 bucket.

This was mentioned in PR #923 by @awsactran.

The process is fairly simple:

• ensure the reports will maintain a good level of quality with very few false positives
• share access for ingestion (will be used for validation as well)
• ensure the bucket is configured correctly so that reports can be ingested successfully

[awsactran]

@calebbrown

Thank you so much for creating this tracking issue and for all the valuable work you're doing with the OSSF Malicious Packages repository. I personally really appreciate the effort.

Regarding the Amazon Inspector S3 integration, I'd like to propose a more secure and maintainable approach for the access configuration. Instead of using long-term credentials (which would be difficult to be approved by our central Security team / SecOps for external consumption), would you be willing to create an IAM role/or account ID that we can onboard as a trusted entity?

Here's how this would work:

• You create an IAM role on your side, or just give us an AWS account ID.
• We onboard your IAM role/Account ID as a trusted entity in our system
• We provide you with our role ARN and target S3 bucket details
• Your role/your account can then assume our role to access the bucket when needed

This approach has several benefits:

• Eliminates the need for long-term credentials management on both sides
• Provides better security through temporary, scoped access
• Reduces operational overhead for credential rotation and maintenance

What are your thoughts on this approach? I'm happy to discuss the technical details further or adjust the proposal based on your preferences and requirements.

Thanks again for everything,

Chi T.

[awsactran]

@calebbrown How do you think about the proposal above?

[calebbrown]

@awsactran I like the proposal, I was checking with OpenSSF and Google about existing patterns for doing this.

I will get an IAM account set up soon so we can share the ID and start getting the access working. I am unfortunately unable to work on it immediately due to competing priorities, but will have it done by the last week of July.

[calebbrown]

Hi @awsactran, just an update. I am still chasing down an AWS project to create the IAM account.

I do plan to setup OIDC to ensure that the authentication works nicely with GitHub, without needing to store credentials.

[awsactran]

@calebbrown Quick check-in on this. I know the process may take time. I am wondering if I can also contribute to this support?

[calebbrown]

@awsactran Sorry for the slow progress. I am still working on getting this done.