feat: Code signing support #658 #691
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
antonbabenko
requested changes
Jul 29, 2025
| function_name = random_pet.this.id | ||
| handler = "index.lambda_handler" | ||
| runtime = "python3.12" | ||
| create_package = false |
There was a problem hiding this comment.
create_package = true should also be supported.
We also need to ensure that the module creates all the AWS Signer resources required for this (conditionally), as this is key to implementing this feature within the module.
| ############### | ||
|
|
||
| variable "enable_code_signing" { | ||
| description = "Must be used with a lambda storing code on s3. Set this to true for triggering a signing job creating a signed copy of the lambda zip. https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html" |
There was a problem hiding this comment.
Please remove links in the descriptions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Is your request related to a new offering from AWS?
Yes ✅: please list the AWS provider version which introduced this functionality
All visible on https://github.com/terraform-aws-modules/terraform-aws-lambda/blob/master/examples/code-signing/main.tf#L55
Is your request related to a problem? Please describe.
To support code signing with this module it's required to pre-zip and upload the file to s3. This causes an issue when we rely on the packaging happening within the module as the zip is produced within the module and can't be signed.
Describe the solution you'd like.
Add a aws_signer_signing_job resource with expected variables:
[required] enable code signing
[required] signing profile_name
[optional] destination s3 prefix otherwise use the same as var.s3_prefix
[optional] destination s3 bucket otherwise use the same bucket as var.s3_bucket
Describe alternatives you've considered.
I tried to use the output module.this.s3_object.bucket to sign it and inject it to the s3_existing_package but that creates a looping dependency.
Additional context
Checkov rates code signing as a high finding: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272
Breaking Changes
No
How Has This Been Tested?
examples/code-signing/main.tfto demonstrate and validate my change(s)