@aws-cdk/aws-signer

AWS::Signer Construct Library

---

---

AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and from a trusted publisher. For more information, see What Is AWS Signer?

Table of Contents

• Signing Platform
• Signing Profile

Signing Platform

A signing platform is a predefined set of instructions that specifies the signature format and signing algorithms that AWS Signer should use to sign a zip file. For more information go to Signing Platforms in AWS Signer.

AWS Signer provides a pre-defined set of signing platforms. They are available in the CDK as -

Platform.AWS_IOT_DEVICE_MANAGEMENT_SHA256_ECDSA
Platform.AWS_LAMBDA_SHA384_ECDSA
Platform.AMAZON_FREE_RTOS_TI_CC3220SF
Platform.AMAZON_FREE_RTOS_DEFAULT

Signing Profile

A signing profile is a code-signing template that can be used to pre-define the signature specifications for a signing job. A signing profile includes a signing platform to designate the file type to be signed, the signature format, and the signature algorithms. For more information, visit Signing Profiles in AWS Signer.

The following code sets up a signing profile for signing lambda code bundles -

const signingProfile = new signer.SigningProfile(this, 'SigningProfile', { 
  platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
});

A signing profile is valid by default for 135 months. This can be modified by specifying the signatureValidityPeriod property.

Changelog

1.147.0 (2022-03-01)

Features

• cfnspec: cloudformation spec v58.0.0 (#19153) (a6b0a10)
• cli: hotswap support for resources in nested stacks (#18950) (2ea9da1)
• ec2: add c6a instances (#19113) (427cdfd)

Bug Fixes

• apigateway: fix strange vtl template for cors preflight request (#19104) (59ef06a), closes /datatracker.ietf.org/doc/html/rfc6454#section-7
• aws-apigateway: api gateway usage plan (#19023) (5b764cc), closes #18994
• aws-lambda-python: skip default docker build when image passed (#19143) (7300f2e), closes #18082
• cli: cdk version displays notices (#19181) (fa16f7a)
• cli: long connection timeout slows the CLI down (#19187) (6595d04)
• custom-resources: physical resource id must be determined before isComplete (#18630) (c190367)
• dynamodb: grant*Data() methods are missing the dynamodb:DescribeTable permission (#19129) (4a44a65), closes #18773
• dynamodb: Table.grantWriteData() doesn't include enough KMS permissions (#19102) (77f1e0b), closes #10010
• ec2: invalid volume type check for iops (#19073) (3f49f02)
• eks: Helm charts fail to install when provided as an asset (#19180) (9961257)
• lambda-nodejs: logLevel property of BundlingOptions is ignored when nodeModules are defined (#18456) (5c40b90), closes #18383
• stepfunctions-tasks: RUN_JOB integration pattern not supported for CallAwsService (#19186) (4b134b7), closes #19174
• apply tags to nested stack (#19128) (3af329b), closes #17463
• triggers: not published as part of v2 (#19168) (8f727d1), closes #19164
• construct paths are not printed for nested stacks in CLI output (#18725) (b0e0155)
• rds: MySQL Cluster version 8.0 uses wrong Parameter for S3 import (#19145) (96b2034), closes #19126