amazonInspector: Amazon Inspector Scan

• archivePath : String

  Image Id Guidance:

  The image can be local, remote, or archived. Image names should follow the Docker naming convention.

  • Local or remote containers: NAME[:TAG|@DIGEST]
  • Tar file: /path/to/image.tar

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• artifactPath : String
• archiveType : String
• osArch : boolean
• iamRole : String
• awsRegion : String
• credentialId : String

  Used inside the plugin to pull the password from Jenkins' credential store. Only required if the image being scanned is located in a private repository requiring credentials to access.

• awsProfileName : String
• awsCredentialId : String

  Optional. Allows you to specify AWS credentials explicitly instead of having them be pulled from your system. If this option is omitted, AWS credentials will be obtained via the default provider chain.

  Credentials must be added to the credential store as the "AWS Credentials" type.

  For more info: https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#credentials-default

• sbomgenSelection : String

  Automatic (Recommended): Allows the plugin to download the most recently released version of inspector-sbomgen. This ensures you always have the latest features, security updates, and bug fixes. Requires selection of the operating system and CPU architecture in use.

  Manual: Requires a path to a pre-downloaded version of inspector-sbomgen to be supplied.

  For more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html

• sbomgenPath : String
• countCritical : int
• countHigh : int
• countMedium : int
• countLow : int
• oidcCredentialId : String
• sbomgenSkipFiles : String

  Specifies a list of one or more files or directories to exclude from scanning. Each file path should be separated with commas, for example: build/, node_modules/, tests/

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• epssThreshold : double
• suppressedCveList : String

  CVE suppression list

  Specify a list of CVE identifiers to exclude from vulnerability threshold calculations and EPSS assessment. These CVEs will be detected and reported but will not contribute to build failure decisions.

  Supported Formats:

  • Comma-separated: CVE-2023-1234, CVE-2023-5678, CVE-2024-0001
  • One per line:
    CVE-2023-1234
    CVE-2023-5678
    CVE-2024-0001
  • Mixed format: CVE-2023-1234, CVE-2023-5678
    CVE-2024-0001

  Behavior:

  • Suppressed CVEs are subtracted from vulnerability threshold counts
  • Suppressed CVEs are excluded from EPSS threshold evaluation
  • CVEs will still appear in scan reports and artifacts
  • Detailed logging shows which CVEs were suppressed and their impact

  Note: CVE IDs must follow the format CVE-YYYY-NNNN (e.g., CVE-2023-1234)

• isSuppressedCveEnabled : boolean

  CVE suppression list: Specify CVEs to exclude from threshold calculations and EPSS assessment. Suppressed CVEs appear in reports but won't cause build failures.

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• isAutoFailCveEnabled : boolean

  CVE auto-fail list: Specify CVEs that will always fail the build when detected, regardless of other threshold settings. Provides zero-tolerance enforcement for specific high-risk vulnerabilities.

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• autoFailCveList : String

  CVE auto-fail list

  Specify a list of CVE identifiers that will always fail the build when detected, regardless of other threshold settings.

  Supported Formats:

  • Comma-separated: CVE-2023-9999, CVE-2024-0001
  • One per line:
    CVE-2023-9999
    CVE-2024-0001
  • Mixed format: CVE-2023-9999, CVE-2024-0001
    CVE-2024-0002

  Behavior:

  • Runs independently of vulnerability threshold settings
  • Takes precedence over the CVE suppression list
  • Immediately fails the build when any auto-fail CVE is detected

  Note: CVE IDs must follow the format CVE-YYYY-NNNN (e.g., CVE-2023-1234)

• isLicenseCollectionEnabled : boolean
  Collects license information for packages in your SBOM artifact.
  
  Requirements: Bomerman v1.8.0+ required.
  
  License data will be included in the SBOM output for compliance and reporting purposes.
• isThresholdEnabled : boolean (optional)
• isEpssEnabled : boolean (optional)
• isEpssThresholdEnabled : boolean (optional)

  EPSS threshold: EPSS scores range from 0-1, enter a value between 0 and 1 (e.g., 0.6).

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• isSeverityThresholdEnabled : boolean (optional)

  Severity thresholds: Specifies whether scanned vulnerabilities exceeding a value will cause a build failure.

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html

• reportArtifactName : String (optional)

  Specify a custom name for the generated report artifact. This helps uniquely identify and manage reports, especially when building multiple images.

  For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html