Producing Software Bill of Materials a.k.a SBOMs for Atlassian

This post details the architecture and implementation of Atlassian's SBOM platform. It describes the scheduler component, which uses Bitbucket commit webhooks to trigger Kubernetes jobs. The SBOM Generator Jobs clone repositories and use tools like Syft, cdxgen, and cyclonedx-maven-plugin to produce SBOMs, which are then uploaded to S3. The SBOM Processor, an AWS Lambda function, parses these SBOMs and uploads them to the Atlassian data lake for aggregation and deduplication. The post also quantifies the platform's impact, reporting over 1MM SBOMs generated containing 1.8 billion packages.