The upload-sbom task added in CSHARP-5626 fails with AccessDenied because it assumes a Silkbomb role in the DevProd Platforms ECR account, not the account where the Silkbomb role lives. It needs to assume the correct Silkbomb role so sbom.json is published to Dependency-Track and Kondukto.

There was also an error when uploading the sbom as the libmongocrypt was declared as a dependency of the encryption package but the encryption isn't listed as a known component in the sbom (by design) so it caused failures.