The following plugin provides functionality available through Pipeline-compatible steps. Read more about how to integrate steps into your Pipeline in the Steps section of the Pipeline Syntax page.
For a list of other such plugins, see the Pipeline Steps Reference page.
amazonInspector: Amazon Inspector ScanarchivePath : String
Image Id Guidance:
The image can be local, remote, or archived. Image names should follow the Docker naming convention.
NAME[:TAG|@DIGEST]/path/to/image.tarFor more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
artifactPath : String
archiveType : String
osArch : boolean
iamRole : String
Optional. The ARN of an IAM role for the plugin to assume, such as arn:aws:iam::111122223333:role/InspectorCICDscan-role. If you choose OIDC Credentials, the plugin assumes the role with that ID token. Otherwise it uses the credentials that the Jenkins controller already has, such as an EC2 instance profile, and those need permission to call sts:AssumeRole on the role.
If you set more than one authentication option, the plugin uses the first one in this order: AWS Credentials, IAM Role with OIDC Credentials, IAM Role, and then AWS Profile Name. If you set none of them, it uses the default credential provider chain on the Jenkins controller.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
awsRegion : String
Required. The AWS Region to send the scan request to. When the plugin assumes an IAM role, it also calls AWS STS in this Region.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
credentialId : String
Used inside the plugin to pull the password from Jenkins' credential store. Only required if the image being scanned is located in a private repository requiring credentials to access.
awsProfileName : String
Optional. The name of a profile in the AWS configuration files of the user that runs the Jenkins controller. It is used only when AWS Credentials and IAM Role are empty.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
awsCredentialId : String
Optional. Allows you to specify AWS credentials explicitly instead of having them be pulled from your system. If this option is omitted, AWS credentials will be obtained via the default provider chain.
Credentials must be added to the credential store as the "AWS Credentials" type.
For more info: https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#credentials-default
sbomgenSelection : String
Automatic (Recommended): Allows the plugin to download the most recently released version of inspector-sbomgen. This ensures you always have the latest features, security updates, and bug fixes. Requires selection of the operating system and CPU architecture in use.
Manual: Requires a path to a pre-downloaded version of inspector-sbomgen to be supplied.
For more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html
sbomgenPath : String
The full path to an inspector-sbomgen binary that you downloaded, such as /opt/inspector/inspector-sbomgen. The file must exist and be executable, and the path can contain only letters, numbers, spaces, periods, underscores, hyphens, colons and forward slashes. The plugin checks the path on the Jenkins controller but runs the binary on the machine that runs the build, so if the build runs on an agent, put the binary at the same path on both.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
countCritical : int
countHigh : int
countMedium : int
countLow : int
oidcCredentialId : String
Optional. An OpenID Connect ID token credential that the plugin uses to assume the IAM Role, so you don't need to store long-term AWS credentials in Jenkins. It is used only when IAM Role is set and AWS Credentials is empty.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
sbomgenSkipFiles : String
Specifies a list of one or more files or directories to exclude from scanning. Each file path should be separated with commas, for example: build/, node_modules/, tests/
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
epssThreshold : double
suppressedCveList : String
Specify a list of CVE identifiers to exclude from vulnerability threshold calculations and EPSS assessment. These CVEs will be detected and reported but will not contribute to build failure decisions.
Note: CVE IDs must follow the format CVE-YYYY-NNNN (e.g., CVE-2023-1234)
isSuppressedCveEnabled : boolean
CVE suppression list: Specify CVEs to exclude from threshold calculations and EPSS assessment. Suppressed CVEs appear in reports but won't cause build failures.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
isAutoFailCveEnabled : boolean
CVE auto-fail list: Specify CVEs that will always fail the build when detected, regardless of other threshold settings. Provides zero-tolerance enforcement for specific high-risk vulnerabilities.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
autoFailCveList : String
Specify a list of CVE identifiers that will always fail the build when detected, regardless of other threshold settings.
Note: CVE IDs must follow the format CVE-YYYY-NNNN (e.g., CVE-2023-1234)
isLicenseCollectionEnabled : boolean
isThresholdEnabled : boolean (optional)
isEpssEnabled : boolean (optional)
isEpssThresholdEnabled : boolean (optional)
EPSS threshold: Fails the build when any vulnerability has an EPSS score greater than or equal to the EPSS Threshold value. EPSS scores range from 0 to 1, so enter a value between 0 and 1, such as 0.6. If the value is empty, the check is skipped. Vulnerabilities without an EPSS score and CVEs in the CVE suppression list don't count.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
isMaliciousPackageBlockingEnabled : boolean (optional)
Malicious package blocking: Fails the build when Amazon Inspector identifies any malicious packages in the scanned artifact, regardless of other threshold settings.
If the scan response does not include a readable malicious package count, the check is skipped with a message in the console log and does not fail the build.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
isSeverityThresholdEnabled : boolean (optional)
Severity thresholds: Fails the build when the scan finds more findings of a severity than the limit you set for it in Critical, High, Medium or Low. For example, a Critical limit of 0 fails the build on any critical-severity finding. CVEs in the CVE suppression list don't count.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
reportArtifactName : String (optional)
Specify a custom name for the generated report artifact. This helps uniquely identify and manage reports, especially when building multiple images.
For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html
Please submit your feedback about this page through this quick form.
Alternatively, if you don't wish to complete the quick form, you can simply indicate if you found this page helpful?
See existing feedback here.