Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- On November 6, 2026, AWS announced a continuously updated, organization-wide inventory of software packages and applications, built from Inspector SBOMs for EC2, ECR, and Lambda.
- It populates where Inspector is enabled and requires no additional inventory configuration. The announcement does not say that enabling Security Hub automatically enables Inspector.
- The SBOM page shows package version, type, and associated resource count. Filter or group by package attributes, account, and Region; use Installed software on a resource detail page for a closer look.
- The inventory is included with Security Hub Essentials at no additional inventory cost and is available where Security Hub is offered. Charges for Inspector and other services require a separate check.
What problem does the software inventory solve?
An SBOM, or software bill of materials, lists software packages or components. On November 6, 2026, AWS added a continuously updated, organization-wide SBOM inventory to Security Hub so central security teams can see packages and applications installed on compute resources.
The inventory helps teams trace a package to associated resources and understand its function and importance while triaging security findings. It supplies investigation context; a listed package has not necessarily been assessed for vulnerabilities or remediated.
What needs to be in place in Inspector?
AWS names three data sources: SBOMs that Amazon Inspector generates for Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions. The announcement does not extend this coverage to every AWS service or cloud resource.
AWS says the inventory populates automatically where Inspector is enabled, with no additional inventory configuration. Check Inspector coverage for the target account and Region first. The announcement does not provide Inspector setup steps, IAM permissions, or other detailed prerequisites, and does not say that enabling Security Hub automatically enables Inspector.
How do you move from a package to a resource?
First, review the SBOM page in Security Hub. It shows package version, type, and the number of resources where a package is installed. Filter or group by package attributes, account, or Region to narrow the investigation.
Second, open a relevant resource detail page and select Installed software to see the packages listed for that resource. Combine this information with the security finding under investigation before assigning follow-up work. Viewing the inventory does not upgrade software or close a finding.
What is confirmed about updates and API queries?
AWS describes the inventory as continuously updated but does not give a refresh interval, latency commitment, retention period, or package-coverage completeness metric in this announcement. To check whether a deployment’s new version is reflected, compare the actual resource and observation time; continuously updated does not establish real-time or zero-latency updates.
The announcement also confirms that the inventory can be queried through the Security Hub API, without naming the API operation or specifying parameters, permissions, and limits. Obtain the relevant official API documentation before integrating it into automation; this announcement alone is insufficient to write an API call.
What does no additional cost cover, and where is it available?
The cost statement is limited to the SBOM inventory being included with Security Hub Essentials at no additional inventory cost. It does not say Essentials, Inspector, or other AWS services are free, and does not list their prices. Check those charges separately when assessing the total cost.
Availability is in all AWS Regions where Security Hub is available, rather than every Region globally. The announcement provides no Region-by-Region list and does not prove that a particular account has enabled the relevant services. Confirm the target Region and Inspector coverage before deciding whether the inventory should appear in your environment.
Sources
Frequently Asked Questions
Should a package on more resources automatically get a higher remediation priority?
Resource count helps describe the potential scope, but it cannot set remediation priority alone. Consider the security finding, affected version, business use, and resource criticality as well. The inventory count is not a risk score.
What should I retain when handing an investigation to an application team?
Record the package name and version, associated resources, account and Region, observation time, and related security finding so the team can review the same scope. This is a suggested investigation record, not a new required field set or API contract announced by AWS.