Using code signing to verify code integrity with Lambda
Code signing for AWS Lambda helps to ensure that only trusted code runs in your Lambda functions. When you enable code signing for a function, Lambda checks every code deployment and verifies that the code package is signed by a trusted source.
Note
Functions defined as container images do not support code signing.
To verify code integrity, use AWS Signer to create digitally signed code packages for functions and layers. When a user attempts to deploy a code package, Lambda performs validation checks on the code package before accepting the deployment. Because code signing validation checks run at deployment time, there is no performance impact on function execution.
You also use AWS Signer to create signing profiles. You use a signing profile to create the signed code package. Use AWS Identity and Access Management (IAM) to control who can sign code packages and create signing profiles. For more information, see Authentication and Access Control in the AWS Signer Developer Guide.
Lambda layers follow the same signed code package format as function code packages. When you add a layer to a function that has code signing enabled, Lambda checks that the layer is signed by an allowed signing profile. When you enable code signing for a function, all layers that are added to the function must also be signed by one of the allowed signing profiles.
You can configure code signing to log changes to AWS CloudTrail. Successful and blocked deployments to functions are logged to CloudTrail with information about the signature and validation checks.
There is no additional charge for using AWS Signer or code signing for AWS Lambda.
Signature validation
Lambda performs the following validation checks when you deploy a signed code package to your function:
-
Integrity – Validates that the code package has not been modified since it was signed. Lambda compares the hash of the package with the hash from the signature.
-
Expiry – Validates that the signature of the code package has not expired.
-
Mismatch – Validates that the code package is signed with one of the allowed signing profiles for the Lambda function. A mismatch also occurs if a signature is not present.
-
Revocation – Validates that the signature of the code package has not been revoked.
The signature validation policy defined in the code signing configuration determines which of the following actions Lambda takes if any of the validation checks fail:
-
Warn – Lambda allows the deployment of the code package, but issues a warning. Lambda issues a new Amazon CloudWatch metric and also stores the warning in the CloudTrail log.
-
Enforce – Lambda issues a warning (the same as for the Warn action) and blocks the deployment of the code package.
You can configure the policy for the expiry, mismatch, and revocation validation checks. Note that you cannot configure a policy for the integrity check. If the integrity check fails, Lambda blocks deployment.
Configuring code signing with the Lambda API
To manage code signing configurations with the AWS CLI or AWS SDK, use the following API operations:
To manage the code signing configuration for a function, use the following API operations:
Topics
