@aws-cdk/aws-signer

AWS::Signer Construct Library

---

All classes with the Cfn prefix in this module (CFN Resources) are always stable and safe to use.

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and from a trusted publisher. For more information, see What Is AWS Signer?

Table of Contents

• Signing Platform
• Signing Profile

Signing Platform

A signing platform is a predefined set of instructions that specifies the signature format and signing algorithms that AWS Signer should use to sign a zip file. For more information go to Signing Platforms in AWS Signer.

AWS Signer provides a pre-defined set of signing platforms. They are available in the CDK as -

Platform.AWS_IOT_DEVICE_MANAGEMENT_SHA256_ECDSA
Platform.AWS_LAMBDA_SHA384_ECDSA
Platform.AMAZON_FREE_RTOS_TI_CC3220SF
Platform.AMAZON_FREE_RTOS_DEFAULT

Signing Profile

A signing profile is a code-signing template that can be used to pre-define the signature specifications for a signing job. A signing profile includes a signing platform to designate the file type to be signed, the signature format, and the signature algorithms. For more information, visit Signing Profiles in AWS Signer.

The following code sets up a signing profile for signing lambda code bundles -

import * as signer from '@aws-cdk/aws-signer';

const signingProfile = new signer.SigningProfile(this, 'SigningProfile', { 
  platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
} );

A signing profile is valid by default for 135 months. This can be modified by specifying the signatureValidityPeriod property.

Changelog

1.93.0 (2021-03-11)

Features

• amplify-domain: Added config for auto subdomain creation (#13342) (4c63f09)
• appmesh: add route retry policies (#13353) (66f7053), closes #11642
• cfnspec: cloudformation spec v30.1.0 (#13519) (7711981)
• codebuild: allow setting queued timeout (#13467) (e09250b), closes #11364
• dynamodb: custom timeout for replication operation (#13354) (6a5a4f2), closes #10249
• ec2: ESP and AH IPsec protocols for Security Groups (#13471) (f5a6647), closes #13403
• ec2: multipart user data (#11843) (ed94c5e), closes #8315
• ecr: add imageTagMutability prop (#10557) (c4dc3bc), closes #4640
• ecs: ability to access tag parameter value of TagParameterContainerImage (#13340) (e567a41), closes #13202
• ecs: allow users to provide a CloudMap service to associate with an ECS service (#13192) (a7d314c), closes #10057
• events: EventBus.grantPutEventsTo method for granular grants (#13429) (122a232), closes #11228
• events: dead-letter queue support for CodeBuild (#13448) (abfc0ea), closes #13447
• events: dead-letter queue support for StepFunctions (#13450) (0ebcb41), closes #13449
• events,applicationautoscaling: schedule can be a token (#13064) (b1449a1)
• iam: SAML identity provider (#13393) (faa0c06), closes #5320
• neptune: Support IAM authentication (#13462) (6c5b1f4), closes #13461
• region-info: added AppMesh ECR account for af-south-1 region (#12814) (b3fba43)
• stepfunctions-tasks: Support calling ApiGateway REST and HTTP APIs (#13033) (cc608d0), closes #11565 #11566 #11565

Bug Fixes

• cfn-include: allow boolean values for string-typed properties (#13508) (e5dab7c)
• ec2: fix typo's in WindowsImage constants (#13446) (781aa97)
• elasticloadbalancingv2: upgrade to v1.92.0 drops certificates on ALB if more than 2 certificates exist (#13490) (01b94f8), closes #13332 #13437
• events: imported EventBus does not correctly register source account (#13481) (57e5404), closes #13469
• iam: oidc-provider can't pull from hosts requiring SNI (#13397) (90dbfb5)
• iam: policy statement tries to validate tokens (#13493) (8d592ea), closes #13479
• init: Python init template's stack ID doesn't match other languages (#13480) (3f1c02d)
• stepfunctions: no validation on state machine name (#13387) (6c3d407), closes #13289