CLOUD SERVICE · AWS

AWS Signer - AWS Signer is a managed code-signing service for establishing the authenticity and integrity of supported software artifacts.

AWS Signer creates digital signatures for supported workloads, including AWS Lambda deployment packages, container images, and AWS IoT firmware. Engineers use signing profiles, access policies, and platform-specific verification controls to distinguish approved software from modified or untrusted artifacts.

Cloud Services Hub →

What is AWS Signer

Read the extensive description

AWS Signer provides managed digital signing for supported software distribution workflows. A signature allows a verifier to check that an artifact has not changed since it was signed and that it was signed by an identity the verifier trusts. Signing does not inspect software for vulnerabilities or establish that its behavior is safe; it supplies an authenticity and integrity control that complements testing, scanning, and deployment authorization.

The main configuration resource is a signing profile. A profile selects a supported signing platform and defines settings such as signature validity where applicable. Profile versions identify specific signing configurations, allowing consumers to trust an explicitly approved version rather than an unrestricted signing identity. Platform requirements differ: Lambda and container workflows use AWS-managed signing certificates, while supported IoT workflows can use a signing certificate registered in AWS Certificate Manager.

For supported file-based workflows, a signing job reads an artifact from Amazon S3 and writes the signed output to an S3 destination. The source object must meet the selected platform's requirements, including applicable S3 versioning requirements. Build systems should record the source object version, signing job identifier, signing profile version, and destination artifact so that a release can be traced back to its inputs.

For Lambda ZIP deployment packages, attach a code signing configuration to the function and specify the signing profile versions that are allowed to publish trusted code. Lambda can warn about or reject packages that fail its signing checks according to the configured policy. This mechanism does not apply to Lambda functions deployed as container images, which need a separate container-signing and verification workflow.

For container images, AWS Signer integrates with the Notation command-line tool through its signing plugin. Images and their signatures can be stored in Amazon Elastic Container Registry. Sign and deploy images by digest to avoid ambiguity from mutable tags, and configure a Notation trust policy that identifies the accepted signing identities. Container signature enforcement must be implemented in the delivery pipeline or runtime admission path; storing a signature in a registry does not by itself prevent an unsigned image from running.

Operational controls should separate permission to build artifacts, permission to request signatures, and permission to change trusted signing profiles. Cross-account permissions can support a central signing account serving multiple application accounts. Where supported, revoke individual signatures or profile versions when a release or signing identity must no longer be trusted, and confirm that downstream verification checks revocation status. Use AWS CloudTrail to audit signing activity and configuration changes, and retain release metadata independently of temporary build environments.

Key AWS Signer Features

Platform-specific signing profiles

Create profiles for supported signing platforms rather than treating every artifact as an arbitrary file. Record the profile version used for each release so that verification policies can trust a precise signing configuration.

Managed signing infrastructure

For Lambda and container signing, AWS Signer manages the signing certificates and underlying signing infrastructure. Supported IoT signing workflows have different certificate requirements, including certificates registered in AWS Certificate Manager.

S3-based signing jobs

Submit supported artifacts from Amazon S3 and retrieve signed output from a configured destination. Track object versions and signing job status so builds do not accidentally deploy an unsigned or outdated object.

Lambda code-signing support

Sign Lambda ZIP deployment packages and configure functions to accept designated signing profile versions. Use enforcement mode to reject packages that fail signing checks, or warning mode when introducing the control.

Container signing with Notation

Use the AWS Signer plugin for Notation to sign container image digests. Verification combines a Notation trust policy with the AWS Signer verification workflow, including applicable revocation checks.

Signature and profile-version revocation

Revoke supported signatures or signing profile versions when a release or signing identity should no longer be trusted. Revocation only affects deployment decisions when the consuming verification workflow evaluates it.

Cross-account signing permissions

Grant other AWS accounts permission to use a signing profile through supported resource-based permissions. This allows a security-owned signing account to serve application pipelines without sharing private signing keys.

Auditable signing operations

Use CloudTrail records to investigate signing requests, profile changes, and revocation actions. Correlate these events with build identifiers and artifact digests in release records.

AWS Signer Use Cases

Restricting Lambda deployments to approved publishers

Sign release ZIP packages with an approved profile and configure Lambda to enforce allowed profile versions. This prevents deployment of packages that do not satisfy the function's code-signing configuration.

Verifying container releases

Sign a container image digest after testing and scanning, then verify it before promotion or deployment. Keep digest-based image references throughout the pipeline so verification applies to the exact image being released.

Authenticating device firmware updates

Sign firmware for a supported AWS IoT signing platform and distribute it through an OTA update workflow. Devices must implement the corresponding verification behavior and contain the appropriate trust material.

Centralizing release-signing authority

Maintain signing profiles in a dedicated account and grant narrowly scoped access to application delivery roles. Separate profile administration from routine signing requests to reduce the impact of a compromised build role.

Responding to an untrusted release

Revoke a supported release signature or profile version and update deployment controls as needed. Test the response path in advance because already running workloads and devices do not automatically roll back when a signature is revoked.

AWS Signer pricing models

No additional AWS Signer service charge

AWS Signer is available at no additional charge. Standard charges apply to supporting resources, such as S3 storage and requests, ECR storage and data transfer, and build infrastructure used to sign or verify artifacts.

Services AWS Signer integrates with

A common architecture separates artifact production, signing, and deployment. A build uploads a supported package to versioned S3 storage or pushes a container image to ECR. A release step then requests signing through an approved AWS Signer profile. Store the signing profile version, artifact digest or S3 object version, and signing result alongside the release record.Verification belongs at the point where software is accepted for deployment. Lambda provides a native code signing configuration for ZIP packages, allowing the function to warn about or reject packages that fail its checks. Container workflows typically run Notation verification in a promotion pipeline or admission control component. ECR stores images and signatures, but signature storage is not equivalent to deployment enforcement. For AWS IoT firmware, devices need compatible verification code and the correct trust material.For multi-account environments, a dedicated signing account can expose narrowly scoped profile permissions to application build roles. Keep profile administration separate from signing execution, and use CloudTrail to audit both. Test revocation behavior across each verifier, because revoking a signature does not automatically remove running containers, roll back Lambda code, or replace firmware already installed on devices.

AWS CloudTrail

CloudTrail records AWS Signer API activity for operational auditing and security investigations. For example, investigators can correlate a signing request or profile revocation with the calling role and release timestamp. Retain the artifact digest or source object version in release metadata to connect API events to deployed software.

Open AWS CloudTrail →

AWS Lambda

Lambda code signing configurations identify trusted signing profile versions for ZIP deployment packages. For example, a production function can enforce a policy that accepts only packages signed through the release team's profile. This control does not cover Lambda container-image deployments.

Open AWS Lambda →

Amazon S3

S3 supplies source artifacts and receives signed output for supported signing jobs. For example, a build can upload a versioned Lambda ZIP, submit its object version to AWS Signer, and deploy the resulting signed package. Configure bucket policies and retention so signed release artifacts remain traceable.

Open Amazon S3 →

AWS CodeBuild

CodeBuild can invoke AWS Signer APIs or run Notation with the AWS Signer plugin as part of a release build. For example, a build can test a container, push it to ECR, sign the resulting digest, and run verification before marking the release successful. Give the build role only the signing permissions and repository access it needs.

Open AWS CodeBuild →

AWS IoT Device Management

AWS IoT OTA workflows can use AWS Signer with supported firmware signing platforms. For example, an OTA release can distribute a signed firmware image to devices configured with the matching verification certificate. The device firmware and boot or update logic must perform the required signature checks.

Open AWS IoT Device Management →