@aws-cdk/aws-signer

AWS::Signer Construct Library

---

---

AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and from a trusted publisher. For more information, see What Is AWS Signer?

Table of Contents

• Signing Platform
• Signing Profile

Signing Platform

A signing platform is a predefined set of instructions that specifies the signature format and signing algorithms that AWS Signer should use to sign a zip file. For more information go to Signing Platforms in AWS Signer.

AWS Signer provides a pre-defined set of signing platforms. They are available in the CDK as -

Platform.AWS_IOT_DEVICE_MANAGEMENT_SHA256_ECDSA
Platform.AWS_LAMBDA_SHA384_ECDSA
Platform.AMAZON_FREE_RTOS_TI_CC3220SF
Platform.AMAZON_FREE_RTOS_DEFAULT

Signing Profile

A signing profile is a code-signing template that can be used to pre-define the signature specifications for a signing job. A signing profile includes a signing platform to designate the file type to be signed, the signature format, and the signature algorithms. For more information, visit Signing Profiles in AWS Signer.

The following code sets up a signing profile for signing lambda code bundles -

import * as signer from '@aws-cdk/aws-signer';

const signingProfile = new signer.SigningProfile(this, 'SigningProfile', { 
  platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
} );

A signing profile is valid by default for 135 months. This can be modified by specifying the signatureValidityPeriod property.

Changelog

1.100.0 (2021-04-20)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• appmesh: HTTP2 VirtualNodeListeners must be now created with Http2VirtualNodeListenerOptions
• appmesh: HTTP2 VirtualGatewayListeners must be now created with Http2VirtualGatewayListenerOptions
• codepipeline-actions: the Action ServiceCatalogDeployAction has been renamed to ServiceCatalogDeployActionBeta1
• codepipeline-actions: the type ServiceCatalogDeployActionProps has been renamed to ServiceCatalogDeployActionBeta1Props
• events-targets: The BatchJob integration now requires the arn and the Resource for the jobQueue and the jobDefinition
• lambda-event-sources: cluster was removed from ManagedKafkaEventSourceProps and replaced with clusterArn
• route53-targets: ApiGatewayv2Domain was replaced with ApiGatewayv2DomainProperties which accepts regionalDomainName and regionalHostedZoneId
• stepfunctions-tasks: CallApiGatewayHttpApiEndpoint API now requires the apiId and it's containing Stack
• stepfunctions-tasks: BatchSubmitJob now accept jobDefinitionArn, jobQueueArn and their respective Resource
• stepfunctions-tasks: RunBatchJob now accept jobDefinitionArn, jobQueueArn and their respective Resource

Features

• apigateway: integration timeout (#14154) (d02770e), closes #14123
• appmesh: add Connection Pools for VirtualNode and VirtualGateway (#13917) (8a949dc), closes #11647
• certificatemanager: allow tagging DnsValidatedCertificate (#13990) (8360feb), closes #12382 #12382
• codebuild: allow setting concurrent build limit (#14185) (3107d03)
• codepipeline: introduce the Action abstract class (#14009) (4b6a6cc)
• ecs: add support for elastic inference accelerators in ECS task defintions (#13950) (23986d7), closes #12460
• eks: Pass bootstrap.sh args to avoid DescribeCluster call and make nodes join the cluster faster (#12659) (f5616cc)
• secretsmanager: replicate secrets to multiple regions (#14266) (b3c288d), closes #14061

Bug Fixes

• codepipeline: incorrect determination of the Action's account when using an imported resource (#14224) (d88e915), closes #14165
• core: toJsonString() does not deal correctly with list tokens (#14138) (1a6d39f), closes #14088
• pipelines: incorrect BuildSpec in synth step if synthesized with --output (#14211) (0f5c74f), closes #13303
• rds: database instances cannot be to be referenced in a different region (#13865) (74c7fff), closes #13832