Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configuring code signing for Amazon Lambda

Code signing for Amazon Lambda helps to ensure that only trusted code runs in your Lambda functions. When you enable code signing for a function, Lambda checks every code deployment and verifies that the code package is signed by a trusted source.

To verify code integrity, use Amazon Signer to create digitally signed code packages for functions and layers. When a user attempts to deploy a code package, Lambda performs validation checks on the code package before accepting the deployment. Because code signing validation checks run at deployment time, there is no performance impact on function execution.

You also use Amazon Signer to create signing profiles. You use a signing profile to create the signed code package. Use Amazon Identity and Access Management (IAM) to control who can sign code packages and create signing profiles. For more information, see Authentication and Access Control in the Amazon Signer Developer Guide.

To enable code signing for a function, you create a code signing configuration and attach it to the function. A code signing configuration defines a list of allowed signing profiles and the policy action to take if any of the validation checks fail.

Lambda layers follow the same signed code package format as function code packages. When you add a layer to a function that has code signing enabled, Lambda checks that the layer is signed by an allowed signing profile. When you enable code signing for a function, all layers that are added to the function must also be signed by one of the allowed signing profiles.

Use IAM to control who can create code signing configurations. Typically, you allow only specific administrative users to have this ability. Additionally, you can set up IAM policies to enforce that developers only create functions that have code signing enabled.

You can configure code signing to log changes to Amazon CloudTrail. Successful and blocked deployments to functions are logged to CloudTrail with information about the signature and validation checks.

You can configure code signing for your functions using the Lambda console, the Amazon Command Line Interface (Amazon CLI), Amazon CloudFormation, and the Amazon Serverless Application Model (Amazon SAM).

There is no additional charge for using Amazon Signer or code signing for Amazon Lambda.

Signature validation

Lambda performs the following validation checks when you deploy a signed code package to your function:

The signature validation policy defined in the code signing configuration determines which of the following actions Lambda takes if any of the validation checks fail:

You can configure the policy for the expiry, mismatch, and revocation validation checks. Note that you cannot configure a policy for the integrity check. If the integrity check fails, Lambda blocks deployment.

Configuration prerequisites

Before you can configure code signing for a Lambda function, use Amazon Signer to do the following:

For more information, see Creating Signing Profiles (Console) in the Amazon Signer Developer Guide.

Creating code signing configurations

A code signing configuration defines a list of allowed signing profiles and the signature validation policy.

Updating a code signing configuration

When you update a code signing configuration, the changes impact the future deployments of functions that have the code signing configuration attached.

Deleting a code signing configuration

You can delete a code signing configuration only if no functions are using it.

Enabling code signing for a function

To enable code signing for a function, you associate a code signing configuration with the function.

Configuring IAM policies

To grant permission for a user to access the code signing API operations, attach one or more policy statements to the user policy. For more information about user policies, see Working with identity-based IAM policies in Lambda.

The following example policy statement grants permission to create, update, and retrieve code signing configurations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
          "lambda:CreateCodeSigningConfig",
          "lambda:UpdateCodeSigningConfig",
          "lambda:GetCodeSigningConfig"
        ],
      "Resource": "*" 
    }
  ]
} 

Administrators can use the CodeSigningConfigArn condition key to specify the code signing configurations that developers must use to create or update your functions.

The following example policy statement grants permission to create a function. The policy statement includes a lambda:CodeSigningConfigArn condition to specify the allowed code signing configuration. Lambda blocks any CreateFunction API request if its CodeSigningConfigArn parameter is missing or does not match the value in the condition.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReferencingCodeSigningConfig",
      "Effect": "Allow",
      "Action": [
          "lambda:CreateFunction",
        ],
      "Resource": "*",
      "Condition": {
          "StringEquals": {
              "lambda:CodeSigningConfigArn":  
                  “arn:aws-cn:lambda:us-west-2:123456789012:code-signing-config:csc-0d4518bd353a0a7c6”
          }
      }
    }
  ]
} 

Configuring code signing with the Lambda API

To manage code signing configurations with the Amazon CLI or Amazon SDK, use the following API operations:

To manage the code signing configuration for a function, use the following API operations: