Increasing trust in software supply chain w/ container image signing
summary
AWS adds managed container image signing that creates signing profiles, generates Notation-compliant signatures stored in Amazon ECR, and enforces validation before deploy to Amazon EKS, with revocation endpoints in every region. The demo shows creating a build_signer profile, using the notation client (or Signer plugin) to sign images, and applying a Kyverno trust store and strict or warning policies to block unsigned images at admission time. Integrations include OCI registries, Ratify and OPA Gatekeeper, and optional customer PKI.
AI-written summary · about
chapters (6)
- 0:00Introduction to container signing
- 2:50Challenges with trusted boundaries
- 4:57Creating signing profiles in AWS Signer
- 7:27Verifying signatures in production
- 10:16Enforcement and revocation options
- 12:02Q&A and resources
related talks
42mDid you sign this (image)?
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing
35mEnforcing a Secure Supply Chain on Kubernetes
15mSupply chain security: AWS Signer for build attribution
27mNever Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
36mEnforcing a Secure Supply Chain on Kubernetes
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...