Using code signing to verify code integrity with Lambda - Amazon Lambda
Signature validationConfiguring code signing with the Lambda API
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using code signing to verify code integrity with Lambda

Code signing for Amazon Lambda helps to ensure that only trusted code runs in your Lambda functions. When you enable code signing for a function, Lambda checks every code deployment and verifies that the code package is signed by a trusted source.

Note

Functions defined as container images do not support code signing.

To verify code integrity, use Amazon Signer to create digitally signed code packages for functions and layers. When a user attempts to deploy a code package, Lambda performs validation checks on the code package before accepting the deployment. Because code signing validation checks run at deployment time, there is no performance impact on function execution.

You also use Amazon Signer to create signing profiles. You use a signing profile to create the signed code package. Use Amazon Identity and Access Management (IAM) to control who can sign code packages and create signing profiles. For more information, see Authentication and Access Control in the Amazon Signer Developer Guide.

Lambda layers follow the same signed code package format as function code packages. When you add a layer to a function that has code signing enabled, Lambda checks that the layer is signed by an allowed signing profile. When you enable code signing for a function, all layers that are added to the function must also be signed by one of the allowed signing profiles.

You can configure code signing to log changes to Amazon CloudTrail. Successful and blocked deployments to functions are logged to CloudTrail with information about the signature and validation checks.

There is no additional charge for using Amazon Signer or code signing for Amazon Lambda.

Signature validation

Lambda performs the following validation checks when you deploy a signed code package to your function:

  1. Integrity – Validates that the code package has not been modified since it was signed. Lambda compares the hash of the package with the hash from the signature.

  2. Expiry – Validates that the signature of the code package has not expired.

  3. Mismatch – Validates that the code package is signed with one of the allowed signing profiles for the Lambda function. A mismatch also occurs if a signature is not present.

  4. Revocation – Validates that the signature of the code package has not been revoked.

The signature validation policy defined in the code signing configuration determines which of the following actions Lambda takes if any of the validation checks fail:

  • Warn – Lambda allows the deployment of the code package, but issues a warning. Lambda issues a new Amazon CloudWatch metric and also stores the warning in the CloudTrail log.

  • Enforce – Lambda issues a warning (the same as for the Warn action) and blocks the deployment of the code package.

You can configure the policy for the expiry, mismatch, and revocation validation checks. Note that you cannot configure a policy for the integrity check. If the integrity check fails, Lambda blocks deployment.

Configuring code signing with the Lambda API

To manage code signing configurations with the Amazon CLI or Amazon SDK, use the following API operations:

To manage the code signing configuration for a function, use the following API operations:

Topics