Code Signing with AWS Signer - Ensuring Trust for Lambda Functions and Container Images
Apply code signing to Lambda functions and container images, enforce signature verification in CI/CD pipelines, and handle compromises through signature revocation.
Why Code Signing Is Necessary
Code signing is a mechanism that uses cryptography to verify that deployed code comes from a trusted publisher and has not been tampered with. In case a build pipeline is compromised in a supply chain attack, signature verification can stop the deployment of code without a trusted signature. As in the 2020 SolarWinds incident, there are cases in which the build environment becomes a target of intrusion, and code signing is one of the countermeasures. AWS Signer is a fully managed code-signing service that you can use to sign and verify Lambda function deployment packages and container images.
Lambda Code Signing
Lambda's Code Signing Configuration defines the ARNs of trusted signing profiles (up to 20) and the action to take on signature verification failure (Warn or Enforce). In Enforce mode, deployment of unsigned functions or functions signed with untrusted signing profiles is blocked. Warn mode logs verification failures while allowing deployment, useful for gradual adoption. In CI/CD pipelines, you build a flow where CodeBuild builds a ZIP package, signs it via the Signer StartSigningJob API, and passes the signed package's S3 URL to Lambda's UpdateFunctionCode. Signing jobs execute asynchronously and can send completion notifications to EventBridge.
Container Image Signing and CI/CD Integration
AWS Signer supports Notation-format signing for ECR container images. In the CI/CD pipeline's build stage, images are built, signed with Signer, and then pushed to ECR. EKS admission controllers enforce signature verification, rejecting deployment of unsigned images. Signing profiles define the cryptographic algorithm (ECDSA P-256 or RSA) and validity period used for signing; once a profile expires, new signatures cannot be generated but existing signatures remain valid. Signature revocation invalidates code signed with a compromised signing profile. After revocation, signature verification fails and deployment of affected code is blocked.
Signing Profile Operational Design
Signing profile design should align with your organization's deployment structure. Creating separate profiles per team limits the blast radius when a profile is compromised to that team's artifacts. Profile validity periods that are too short increase rotation overhead, while periods too long extend risk windows during compromise, so set them according to organizational risk tolerance. If IAM policies restrict signer:StartSigningJob execution to specific roles (CI/CD pipeline build roles) so that individual developers cannot sign, only those build roles can sign. CloudTrail records signing operations and leaves an audit trail of who signed what and when.
Comparison with Other Signing Methods
Beyond AWS Signer, several alternatives exist for code signing. Cosign (Sigstore project) is an open-source container signing tool supporting keyless signing (ephemeral certificates) but requires self-managing signing infrastructure and key management. AWS Signer provides managed key generation, storage, and rotation with KMS integration ensuring keys are protected by hardware security modules (HSM). GPG signing is used for git commit signatures, while deployment-time verification for Lambda or ECR uses a separate mechanism. AWS Signer works with Lambda Code Signing Configuration and EKS admission controllers to enforce deployment-time verification without additional infrastructure. However, for multi-cloud environments with unified signing policies, one option is a configuration that uses Notation or Cosign.
Signer Pricing
Using AWS Signer with services such as AWS Lambda, Amazon ECR, and Amazon EKS incurs no additional charge. Signature verification is free. There are no additional charges for managing signing profiles.
Summary
AWS Signer is a fully managed service that provides code signing for Lambda functions and container images to check the integrity of deployed code. Signing during the CI/CD pipeline's build stage and enforcing verification through Lambda's code signing configuration or EKS admission controllers adds a defense layer against supply chain attacks. A design that separates signing profiles by team and restricts signing permissions with IAM narrows the blast radius when a compromise occurs.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.