Overview¶

ts-obom extracts an Operations Bill of Materials (OBOM) from infrastructure-as-code and writes it as a CycloneDX document. The OBOM lists the resources a module is deployed as -- functions, tables, buckets, queues, task definitions -- and, on top of that inventory, the access graph: which identity may perform which actions on which resource, and through which policy that grant was made.

It is the infrastructure counterpart to ts-scan, which builds the Software Bill of Materials. An SBOM tells you what is inside the software; the OBOM tells you what it is operated as and what it is allowed to touch once it runs. Together they give threat modelling and trust-boundary analysis the evidence that neither can provide alone.

ts-obom works entirely offline on CloudFormation, AWS SAM, Terraform and OpenTofu sources. It needs no cloud credentials, no Terraform init and no Checkov installation.

This site is meant to get you to a useful result quickly. To jump straight in:

• Architecture Overview & supported front-ends
• Installation
• Capabilities
  • See the Usage page for general guidance
  • Describing deployments — one document per environment or customer setup
  • Result format — what the CycloneDX and the native output contain
• Operations examples
  • One OBOM per environment, from the pipeline
  • Transferring results to TrustSource
  • Operating inside a container
• Contributing
  • Adding features and the development guidelines
  • Roadmap

Getting Support¶

ts-obom is open source and supported through this repository. As a TrustSource subscriber, you may contact TrustSource support for help. As a community user, please file a ticket with the repo.

You may also find additional information and learning materials in our open TrustSource Knowledgebase.

Reporting Vulnerabilities¶

TrustSource supports a coordinated vulnerability disclosure procedure for its platform. ts-obom follows that schema and vulnerabilities identified should follow this procedure. Please find all details in our Security Policy.