Supply chain security: AWS Signer for build attribution
summary
Cisco describes a working build-attribution setup that uses AWS Signer to add verifiable signatures to Lambda zips and ECR images, integrated into GitHub Actions and CloudFormation. Lambdas enforce signatures via a signing configuration; container signing uses Notation CLI with AWS plugin (and the Notation Go API for CloudWatch-triggered validation). Key quirks: you must use a versioned S3 object or image SHA and the signing profile version ARN, ECS requires extra verify-and-watch logic, and deleting images requires removing signature and index artifacts.
AI-written summary · about
chapters (9)
- 0:00Introduction to supply chain
- 1:05Why use AWS Signer
- 4:59Code signing benefits
- 5:22Lambda signing architecture
- 6:49Lambda signature validation
- 8:35Container signing with ECS
- 10:22ECS signature validation
- 11:44Post-deployment monitoring
- 13:34Lessons learned and next steps
related talks
13mIncreasing trust in software supply chain w/ container image signing
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
36mSpicing up Container Image Security with SLSA & GUAC
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
17mVerifiable Build Environments in the Cloud: Powered by Sigstore and Enclaves
29mMake Your CI More Secure and Less Spicy with SLSA
41mSoftware Delivery Shield: securing the serverless software supply chain
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub