Securing the Software Supply Chain on AWS: From SBOM to Signed, Verified Deploys

1. The problem : why supply chain attacks (SolarWinds, xz-utils, dependency confusion) matter for AWS workloads specifically, not just on-prem
2. Mapping the chain : source → build → artifact → registry → deploy → runtime, and where AWS gives you native controls at each stage
3. SBOM generation : CodeGuru / native tooling + open-source generators (Syft), where to store SBOMs (ECR, S3, artifact metadata)