(lambda): Add ability to sign code using a code signing profile

[dontirun]

Lambda supports now code signing . I suggest the CDK should add the ability to take a signer profile and sign unbundled/bundled assets after they are uploaded to S3. (This will require versioning to be enabled on the Bootstrap bucket)

I can currently do this with CloudFormation deployments utilizing the SAM CLI but not with the CDK

Use Case

I would like to verify the Lambda functions that I deploy as part of a Pipeline have been created by a trusted entity and unmodified.

---

This is a 🚀 Feature Request

[nija-at]

This feature is not yet available in CloudFormation.

[dontirun]

Although the CloudFormation documentation says it's unsupported, the SAM documentation for the CodeSigningConfigArn says that it is supported and passes it directly to that property for CloudFormation

[dontirun]

Additionally the ability to use signed code is independent from the CodeSigning config on the lambda function. The code needs to be signed via AWS Signer using a valid profile. If the Lambda then has the proper configuration the signing profile then the function will properly deploy.

This ask is to implement both parts (with lambda bundling/assets)

This is the code used in the SAM CLI to upload the code to and S3 bucket, start the signing job, and then returned the S3 location to the signed artifact.

[nija-at]

Thanks for letting me know that this is available in CloudFormation.

[dontirun]

I really appreciate the work that has gone into PR #12656 , but I do not believe the PR will fully address this issue. If the code signing profile is set to Enforce, and I specify local code the deployment will fail due to code not being signed. The PR will resolve all the CloudFormation related aspects of this request, but there is an additional component to sign the code after it is uploaded to S3 (which I believe the CDK can handle)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.