@aws-cdk/aws-signer

AWS::Signer Construct Library

---

---

AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and from a trusted publisher. For more information, see What Is AWS Signer?

Table of Contents

• Signing Platform
• Signing Profile

Signing Platform

A signing platform is a predefined set of instructions that specifies the signature format and signing algorithms that AWS Signer should use to sign a zip file. For more information go to Signing Platforms in AWS Signer.

AWS Signer provides a pre-defined set of signing platforms. They are available in the CDK as -

Platform.AWS_IOT_DEVICE_MANAGEMENT_SHA256_ECDSA
Platform.AWS_LAMBDA_SHA384_ECDSA
Platform.AMAZON_FREE_RTOS_TI_CC3220SF
Platform.AMAZON_FREE_RTOS_DEFAULT

Signing Profile

A signing profile is a code-signing template that can be used to pre-define the signature specifications for a signing job. A signing profile includes a signing platform to designate the file type to be signed, the signature format, and the signature algorithms. For more information, visit Signing Profiles in AWS Signer.

The following code sets up a signing profile for signing lambda code bundles -

import * as signer from '@aws-cdk/aws-signer';

const signingProfile = new signer.SigningProfile(this, 'SigningProfile', { 
  platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
} );

A signing profile is valid by default for 135 months. This can be modified by specifying the signatureValidityPeriod property.

Changelog

1.126.0 (2021-10-05)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• assertions: The templateMatches() API previously performed an exact match. The default behavior has been updated to be "object-like".

Features

• assertions: matcher support for templateMatches() API (#16789) (0fb2179)
• apprunner: support the Service L2 construct (#15810) (3cea941), closes #14813
• aws-ec2: userdata cfn-signal signal resource which is different than the attached resource (#16264) (f24a1ae)
• backup: expose method to add statements to the vault policy (#16597) (3ff1537)
• cfnspec: cloudformation spec v42.0.0 (#16639) (2157acd)
• cloudfront: support Behavior-specific viewer protocol policy for CloudFrontWebDistribution (#16389) (5c028c5), closes #7086
• cloudwatch: support cross-environment search expressions (#16539) (c165138), closes #9039
• eks: connectAutoScalingGroupCapacity on imported clusters (#14650) (7f7be08)
• eks: add warning to fargateProfile (#16631) (41fdebb), closes #16349
• stepfunctions-tasks: add step concurrency level to EmrCreateCluster (#15242) (1deea90), closes #15223
• allow stale bot trigger manually (#16586) (fc8cfee)

Bug Fixes

• eks: Support for http proxy in EKS onEvent lambda (#16609) (cf22280), closes /github.com/aws/aws-cdk/blob/7dae114b7aac46321b8d8572e6837428b4c633b2/tools/pkglint/lib/rules.ts#L1332
• eks: support http proxy in EKS onEvent lambda (#16657) (87c9570), closes /github.com/aws/aws-cdk/pull/16657#issuecomment-928260661 /github.com/aws/aws-cdk/pull/16657#issuecomment-928529421 /github.com/aws/aws-cdk/blob/7dae114b7aac46321b8d8572e6837428b4c633b2/tools/pkglint/lib/rules.ts#L1332
• cli: progress bar overshoots count by 1 for stack updates (#16168) (0c8ecb8)
• config: add SourceAccount condition to Lambda permission (#16617) (cfcaf45)
• elasticloadbalancingv2: Incorrect validation on NetworkLoadBalancer.configureHealthCheck() (#16445) (140892a)
• iam: User.fromUserArn does not work for ARNs that include a path (#16269) (5c69c94), closes 40aws-cdk/aws-iam/lib/role.ts#L191-L194 #16256
• s3: setting autoDeleteObjects to false empties the bucket (#16756) (21836f2), closes #16603
• route53-targets: ApiGateway does not accept RestApiBase (#16610) (20071bb), closes #16227
• sns: cannot use numeric filter policy with 0 values (#16551) (62b6762), closes #16549

Reverts

• aws-eks: "fix(aws-eks): Support for http proxy in EKS onEvent lambda" (#16651) (376c837)