v1.2.0 - release prep (#48)

Signed-off-by: kiran kumar <skukiran@amazon.com>
Co-authored-by: kiran kumar <skukiran@amazon.com>

Author: kiran-ammati

CHANGELOG.md

@@ -42,6 +42,17 @@ Thankyou! -->
 ## [Unreleased]
 
 
+## [v1.2.0] - October 16th, 2026
+
+### Added
+* #### Objects
+  1. Extended `image` with `is_public` (reused from core), `source_resource_uid`, `root_device_type`, and `virtualization_type` for AWS machine image (AMI) findings. Extended `resource_details` with `state`/`state_id`, narrowing the generic core `state_id` via an inline, resource-type-agnostic lifecycle enum (Pending/Active/Suspended/Deprovisioned/Failed/Transient) that maps across AWS resource types (AMI, EC2, etc.).
+  1. Extended `affected_package` with `workload_state`, `workload_state_id`, and `workload_state_reason` so vulnerability findings can state whether a vulnerable package is part of the workload the affected resource runs (Inspector package runtime reachability for EC2 and container images).
+* #### Dictionary Attributes
+  1. Added `source_resource_uid`, `root_device_type`, and `virtualization_type` as `string_t`.
+  1. Added `workload_state_id` as an `integer_t` enum (Unknown/Active/Inactive/Other) with sibling `workload_state` as a `string_t`, and `workload_state_reason` as a `string_t` enum of the scanner evidence values (`PACKAGE_IN_DOCKERFILE_WORKLOAD_PATH`, `PACKAGE_NOT_IN_DOCKERFILE_WORKLOAD_PATH`, `PROCESS_OBSERVED_IN_EC2_RUNTIME`, `PROCESS_NOT_OBSERVED_IN_EC2_RUNTIME`).
+
+
 ## [v1.1.0] - May 22nd, 2026
 
 ### Added

dictionary.json

@@ -338,6 +338,63 @@
       "description": "The number of findings that will be fully resolved by remediating this target.",
       "type": "integer_t"
     },
+    "root_device_type": {
+      "caption": "Root Device Type",
+      "description": "The type of root device the machine image uses <code>(e.g. ebs, instance-store)</code>.",
+      "type": "string_t"
+    },
+    "workload_state": {
+      "caption": "Workload State",
+      "description": "The workload state of the affected package, normalized to the caption of the <code>workload_state_id</code> value. In the case of 'Other', it is defined by the event source.",
+      "type": "string_t"
+    },
+    "workload_state_id": {
+      "caption": "Workload State ID",
+      "description": "The normalized workload state of an affected package on the resource: whether the package was determined to be part of the workload the resource runs. The evidence behind the value is described by <code>workload_state_reason</code>.",
+      "sibling": "workload_state",
+      "type": "integer_t",
+      "enum": {
+        "0": {
+          "caption": "Unknown",
+          "description": "The workload state is unknown. The scanner did not evaluate workload state for this package, or the resource type does not support it."
+        },
+        "1": {
+          "caption": "Active",
+          "description": "The package was determined to be part of the workload the resource runs <code>(e.g. a running process was observed on the EC2 instance, or the package is on the container image workload path)</code>."
+        },
+        "2": {
+          "caption": "Inactive",
+          "description": "The package is installed but was not determined to be part of the workload the resource runs <code>(e.g. no running process was observed on the EC2 instance, or the package is not on the container image workload path)</code>."
+        },
+        "99": {
+          "caption": "Other",
+          "description": "The workload state is not mapped. See the <code>workload_state</code> attribute, which contains a data source specific value."
+        }
+      }
+    },
+    "workload_state_reason": {
+      "caption": "Workload State Reason",
+      "description": "The evidence the scanner used to determine the <code>workload_state_id</code> of an affected package.",
+      "type": "string_t",
+      "enum": {
+        "PACKAGE_IN_DOCKERFILE_WORKLOAD_PATH": {
+          "caption": "PACKAGE_IN_DOCKERFILE_WORKLOAD_PATH",
+          "description": "The package is on the workload path declared by the container image's Dockerfile <code>(e.g. ENTRYPOINT, CMD, WORKDIR)</code>. Implies workload state Active."
+        },
+        "PACKAGE_NOT_IN_DOCKERFILE_WORKLOAD_PATH": {
+          "caption": "PACKAGE_NOT_IN_DOCKERFILE_WORKLOAD_PATH",
+          "description": "The package is present in the container image but not on the workload path declared by its Dockerfile. Implies workload state Inactive."
+        },
+        "PROCESS_NOT_OBSERVED_IN_EC2_RUNTIME": {
+          "caption": "PROCESS_NOT_OBSERVED_IN_EC2_RUNTIME",
+          "description": "No running process backed by the package was observed on the EC2 instance during the observation window. Implies workload state Inactive."
+        },
+        "PROCESS_OBSERVED_IN_EC2_RUNTIME": {
+          "caption": "PROCESS_OBSERVED_IN_EC2_RUNTIME",
+          "description": "A running process backed by the package was observed on the EC2 instance. Implies workload state Active."
+        }
+      }
+    },
     "scan_duration": {
       "caption": "Scan Duration",
       "description": "The time span of the network scan job, including start time, end time, and total duration.",
@@ -374,6 +431,11 @@
       "description": "The storage device snapshot identifier <code>(e.g. snap-1234567890abcdef0).</code>",
       "type": "string_t"
     },
+    "source_resource_uid": {
+      "caption": "Source Resource UID",
+      "description": "The unique identifier of the resource the machine image was created from <code>(e.g. the source AMI or instance id)</code>.",
+      "type": "string_t"
+    },
     "storage_device": {
       "caption": "Storage Device",
       "description": "The storage device that is attached to the instance",
@@ -466,6 +528,11 @@
       "description": "The vendor-determined score for the finding, reflecting any adjustments applied by the event source. For example, the vendor's adjusted CVSS score after applying environmental metrics.",
       "type": "float_t"
     },
+    "virtualization_type": {
+      "caption": "Virtualization Type",
+      "description": "The virtualization type of the machine image <code>(e.g. hvm, paravirtual)</code>.",
+      "type": "string_t"
+    },
     "zones": {
       "caption": "List of Availability Zones",
       "description": "A list of availability zones",

extension.json

@@ -3,5 +3,5 @@
   "caption": "AWS",
   "description": "The AWS extension to OCSF adds AWS-specific event classes, objects, attributes, and profiles to the core OCSF schema.",
   "name": "aws",
-  "version": "1.2.0-dev"
+  "version": "1.2.0"
 }

objects/affected_package.json

@@ -0,0 +1,20 @@
+{
+  "caption": "Affected Software Package",
+  "description": "Extends the core Affected Software Package object with the observed workload state of the package on the affected resource, so consumers can distinguish vulnerable packages that are exercised at runtime from those that are merely installed.",
+  "extends": "affected_package",
+  "name": "affected_package",
+  "attributes": {
+    "workload_state": {
+      "description": "The workload state of the affected package, normalized to the caption of the <code>workload_state_id</code> value. In the case of 'Other', it is defined by the event source.",
+      "requirement": "optional"
+    },
+    "workload_state_id": {
+      "description": "The normalized workload state of the affected package on the resource: whether the package was determined to be part of the workload the resource runs <code>(e.g. a process observed on an EC2 instance, or a package on the workload path of a container image)</code>. The evidence behind the value is in <code>workload_state_reason</code>.",
+      "requirement": "optional"
+    },
+    "workload_state_reason": {
+      "description": "The evidence the scanner used to determine <code>workload_state_id</code> for the affected package.",
+      "requirement": "optional"
+    }
+  }
+}

objects/image.json

@@ -20,6 +20,11 @@
       "description": "Number of containers using this image.",
       "requirement": "recommended"
     },
+    "is_public": {
+      "description": "Indicates whether the machine image is publicly shared <code>(e.g. a public AMI)</code>.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional"
+    },
     "last_used_time": {
       "description": "Timestamp of when this image was last used.",
       "requirement": "recommended"
@@ -44,13 +49,28 @@
       "description": "Name of the repository containing this image.",
       "requirement": "recommended"
     },
+    "root_device_type": {
+      "description": "The type of root device the machine image uses <code>(e.g. ebs, instance-store)</code>.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional"
+    },
+    "source_resource_uid": {
+      "description": "The unique identifier of the resource the machine image was created from <code>(e.g. the source AMI or instance id)</code>.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional"
+    },
     "uid": {
       "description": "The unique identifier of the container image.",
       "requirement": "recommended"
     },
     "uid_alt": {
       "description": "This is the Amazon Resource Name (ARN) of the resource.",
       "requirement": "recommended"
+    },
+    "virtualization_type": {
+      "description": "The virtualization type of the machine image <code>(e.g. hvm, paravirtual)</code>.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional"
     }
   },
   "constraints": {

objects/resource_details.json

@@ -59,6 +59,51 @@
       "profile": "cloud",
       "requirement": "recommended"
     },
+    "state": {
+      "description": "The state of the resource, normalized to the caption of the <code>state_id</code> value. In the case of 'Other', it is defined by the event source. This carries the source-specific value <code>(e.g. an AWS AMI image state such as available, or an EC2 instance state such as running)</code>.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional"
+    },
+    "state_id": {
+      "description": "The normalized lifecycle state of the resource, resource-type agnostic. The source-specific value is preserved in the <code>state</code> sibling.",
+      "profile": "aws/cloud_resources",
+      "requirement": "optional",
+      "sibling": "state",
+      "enum": {
+        "0": {
+          "caption": "Unknown",
+          "description": "The state is unset or not provided."
+        },
+        "1": {
+          "caption": "Pending",
+          "description": "The resource is being created or provisioned and is not yet usable <code>(e.g. AMI pending, EC2 pending)</code>."
+        },
+        "2": {
+          "caption": "Active",
+          "description": "The resource is created and in service <code>(e.g. AMI available, EC2 running, an enabled resource)</code>."
+        },
+        "3": {
+          "caption": "Suspended",
+          "description": "The resource is temporarily inactive <code>(e.g. EC2 stopped, a disabled or paused resource)</code>."
+        },
+        "4": {
+          "caption": "Deprovisioned",
+          "description": "The resource has been removed or retired <code>(e.g. AMI deregistered, EC2 terminated, a deleted resource)</code>."
+        },
+        "5": {
+          "caption": "Failed",
+          "description": "The resource creation or operation failed, or the resource is in a bad state <code>(e.g. AMI failed, error, or invalid)</code>."
+        },
+        "6": {
+          "caption": "Transient",
+          "description": "The resource is mid-transition between states <code>(e.g. AMI transient, EC2 stopping or shutting-down)</code>."
+        },
+        "99": {
+          "caption": "Other",
+          "description": "The state is not mapped. See the <code>state</code> attribute, which contains a data source specific value."
+        }
+      }
+    },
     "storage_device": {
       "profile": "aws/cloud_resources",
       "requirement": "optional"