feat(lambda): code signing config (#12656)

closes #12216 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-lambda/README.md

@@ -489,3 +489,27 @@ Language-specific higher level constructs are provided in separate modules:
 
 * `@aws-cdk/aws-lambda-nodejs`: [Github](https://github.com/aws/aws-cdk/tree/master/packages/%40aws-cdk/aws-lambda-nodejs) & [CDK Docs](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-nodejs-readme.html)
 * `@aws-cdk/aws-lambda-python`: [Github](https://github.com/aws/aws-cdk/tree/master/packages/%40aws-cdk/aws-lambda-python) & [CDK Docs](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-python-readme.html)
+
+## Code Signing
+
+Code signing for AWS Lambda helps to ensure that only trusted code runs in your Lambda functions. 
+When enabled, AWS Lambda checks every code deployment and verifies that the code package is signed by a trusted source.
+For more information, see [Configuring code signing for AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html).
+The following code configures a function with code signing.
+
+```typescript
+import * as signer from '@aws-cdk/aws-signer';
+
+const signerProfile = signer.SigningProfile(this, 'SigningProfile', {
+ platform: Platform.AWS_LAMBDA_SHA384_ECDSA
+});
+
+const codeSigningConfig = new lambda.CodeSigningConfig(stack, 'CodeSigningConfig', {
+ signingProfiles: [signingProfile],
+});
+
+new lambda.Function(this, 'Function', {
+ codeSigningConfig,
+ // ...
+});
+```

packages/@aws-cdk/aws-lambda/lib/code-signing-config.ts

@@ -0,0 +1,120 @@
+import { ISigningProfile } from '@aws-cdk/aws-signer';
+import { IResource, Resource, Stack } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import { CfnCodeSigningConfig } from './lambda.generated';
+
+/**
+ * Code signing configuration policy for deployment validation failure.
+ */
+export enum UntrustedArtifactOnDeployment {
+ /**
+ * Lambda blocks the deployment request if signature validation checks fail.
+ */
+ ENFORCE = 'enforce',
+
+ /**
+ * Lambda allows the deployment of the code package, but issues a warning.
+ * Lambda issues a new Amazon CloudWatch metric, called a signature validation error and also stores the warning in CloudTrail.
+ */
+ WARN = 'warn',
+}
+
+/**
+ * A Code Signing Config
+ */
+export interface ICodeSigningConfig extends IResource {
+ /**
+ * The ARN of Code Signing Config
+ * @attribute
+ */
+ readonly codeSigningConfigArn: string;
+
+ /**
+ * The id of Code Signing Config
+ * @attribute
+ */
+ readonly codeSigningConfigId: string;
+}
+
+/**
+ * Construction properties for a Code Signing Config object
+ */
+export interface CodeSigningConfigProps {
+ /**
+ * List of signing profiles that defines a
+ * trusted user who can sign a code package.
+ */
+ readonly signingProfiles: ISigningProfile[],
+
+ /**
+ * Code signing configuration policy for deployment validation failure.
+ * If you set the policy to Enforce, Lambda blocks the deployment request
+ * if signature validation checks fail.
+ * If you set the policy to Warn, Lambda allows the deployment and
+ * creates a CloudWatch log.
+ *
+ * @default UntrustedArtifactOnDeployment.WARN
+ */
+ readonly untrustedArtifactOnDeployment?: UntrustedArtifactOnDeployment,
+
+ /**
+ * Code signing configuration description.
+ *
+ * @default - No description.
+ */
+ readonly description?: string,
+}
+
+/**
+ * Defines a Code Signing Config.
+ *
+ * @resource AWS::Lambda::CodeSigningConfig
+ */
+export class CodeSigningConfig extends Resource implements ICodeSigningConfig {
+ /**
+ * Creates a Signing Profile construct that represents an external Signing Profile.
+ *
+ * @param scope The parent creating construct (usually `this`).
+ * @param id The construct's name.
+ * @param codeSigningConfigArn The ARN of code signing config.
+ */
+ public static fromCodeSigningConfigArn( scope: Construct, id: string, codeSigningConfigArn: string): ICodeSigningConfig {
+ const codeSigningProfileId = Stack.of(scope).parseArn(codeSigningConfigArn).resourceName;
+ if (!codeSigningProfileId) {
+ throw new Error(`Code signing config ARN must be in the format 'arn:aws:lambda:<region>:<account>:code-signing-config:<codeSigningConfigArn>', got: '${codeSigningConfigArn}'`);
+ }
+ const assertedCodeSigningProfileId = codeSigningProfileId;
+ class Import extends Resource implements ICodeSigningConfig {
+ public readonly codeSigningConfigArn = codeSigningConfigArn;
+ public readonly codeSigningConfigId = assertedCodeSigningProfileId;
+
+ constructor() {
+ super(scope, id);
+ }
+ }
+ return new Import();
+ }
+
+ public readonly codeSigningConfigArn: string;
+ public readonly codeSigningConfigId: string;
+
+ constructor(scope: Construct, id: string, props: CodeSigningConfigProps) {
+ super(scope, id);
+
+ const signingProfileVersionArns = props.signingProfiles.map(signingProfile => {
+ return signingProfile.signingProfileVersionArn;
+ });
+
+ const resource: CfnCodeSigningConfig = new CfnCodeSigningConfig(this, 'Resource', {
+ allowedPublishers: {
+ signingProfileVersionArns,
+ },
+ codeSigningPolicies: {
+ untrustedArtifactOnDeployment: props.untrustedArtifactOnDeployment ?? UntrustedArtifactOnDeployment.WARN,
+ },
+ description: props.description,
+ });
+ this.codeSigningConfigArn = resource.attrCodeSigningConfigArn;
+ this.codeSigningConfigId = resource.attrCodeSigningConfigId;
+ }
+}

packages/@aws-cdk/aws-lambda/lib/function.ts

@@ -8,6 +8,7 @@ import * as sqs from '@aws-cdk/aws-sqs';
 import { Annotations, CfnResource, Duration, Fn, Lazy, Names, Stack } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { Code, CodeConfig } from './code';
+import { ICodeSigningConfig } from './code-signing-config';
 import { EventInvokeConfigOptions } from './event-invoke-config';
 import { IEventSource } from './event-source';
 import { FileSystem } from './filesystem';
@@ -290,6 +291,13 @@ export interface FunctionOptions extends EventInvokeConfigOptions {
  * @default - AWS Lambda creates and uses an AWS managed customer master key (CMK).
  */
  readonly environmentEncryption?: kms.IKey;
+
+ /**
+ * Code signing config associated with this function
+ *
+ * @default - Not Sign the Code
+ */
+ readonly codeSigningConfig?: ICodeSigningConfig;
 }
 
 export interface FunctionProps extends FunctionOptions {
@@ -641,6 +649,7 @@ export class Function extends FunctionBase {
  }),
  kmsKeyArn: props.environmentEncryption?.keyArn,
  fileSystemConfigs,
+ codeSigningConfigArn: props.codeSigningConfig?.codeSigningConfigArn,
  });
 
  resource.node.addDependency(this.role);

packages/@aws-cdk/aws-lambda/lib/index.ts

@@ -16,6 +16,7 @@ export * from './event-source-mapping';
 export * from './destination';
 export * from './event-invoke-config';
 export * from './scalable-attribute-api';
+export * from './code-signing-config';
 
 export * from './log-retention';
 

packages/@aws-cdk/aws-lambda/package.json

@@ -99,6 +99,7 @@
  "@aws-cdk/aws-logs": "0.0.0",
  "@aws-cdk/aws-s3": "0.0.0",
  "@aws-cdk/aws-s3-assets": "0.0.0",
+ "@aws-cdk/aws-signer": "0.0.0",
  "@aws-cdk/aws-sqs": "0.0.0",
  "@aws-cdk/core": "0.0.0",
  "@aws-cdk/cx-api": "0.0.0",
@@ -119,6 +120,7 @@
  "@aws-cdk/aws-logs": "0.0.0",
  "@aws-cdk/aws-s3": "0.0.0",
  "@aws-cdk/aws-s3-assets": "0.0.0",
+ "@aws-cdk/aws-signer": "0.0.0",
  "@aws-cdk/aws-sqs": "0.0.0",
  "@aws-cdk/core": "0.0.0",
  "@aws-cdk/cx-api": "0.0.0",
@@ -169,7 +171,8 @@
  "props-default-doc:@aws-cdk/aws-lambda.Permission.sourceArn",
  "docs-public-apis:@aws-cdk/aws-lambda.ResourceBindOptions",
  "docs-public-apis:@aws-cdk/aws-lambda.VersionAttributes",
- "props-physical-name:@aws-cdk/aws-lambda.EventInvokeConfigProps"
+ "props-physical-name:@aws-cdk/aws-lambda.EventInvokeConfigProps",
+ "props-physical-name:@aws-cdk/aws-lambda.CodeSigningConfigProps"
  ]
  },
  "stability": "stable",

packages/@aws-cdk/aws-lambda/test/code-signing-config.test.ts

@@ -0,0 +1,102 @@
+import '@aws-cdk/assert/jest';
+import * as signer from '@aws-cdk/aws-signer';
+import * as cdk from '@aws-cdk/core';
+import * as lambda from '../lib';
+
+let app: cdk.App;
+let stack: cdk.Stack;
+beforeEach( () => {
+ app = new cdk.App( {} );
+ stack = new cdk.Stack( app );
+} );
+
+describe('code signing config', () => {
+ test('default', () => {
+ const platform = signer.Platform.AWS_LAMBDA_SHA384_ECDSA;
+ const signingProfile = new signer.SigningProfile(stack, 'SigningProfile', { platform });
+ new lambda.CodeSigningConfig(stack, 'CodeSigningConfig', {
+ signingProfiles: [signingProfile],
+ });
+
+ expect(stack).toHaveResource('AWS::Lambda::CodeSigningConfig', {
+ AllowedPublishers: {
+ SigningProfileVersionArns: [{
+ 'Fn::GetAtt': [
+ 'SigningProfile2139A0F9',
+ 'ProfileVersionArn',
+ ],
+ }],
+ },
+ CodeSigningPolicies: {
+ UntrustedArtifactOnDeployment: lambda.UntrustedArtifactOnDeployment.WARN,
+ },
+ });
+ });
+
+ test('with multiple signing profiles', () => {
+ const signingProfile1 = new signer.SigningProfile(stack, 'SigningProfile1', { platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA });
+ const signingProfile2 = new signer.SigningProfile(stack, 'SigningProfile2', { platform: signer.Platform.AMAZON_FREE_RTOS_DEFAULT });
+ const signingProfile3 = new signer.SigningProfile(stack, 'SigningProfile3', { platform: signer.Platform.AWS_IOT_DEVICE_MANAGEMENT_SHA256_ECDSA });
+ new lambda.CodeSigningConfig(stack, 'CodeSigningConfig', {
+ signingProfiles: [signingProfile1, signingProfile2, signingProfile3],
+ });
+
+ expect(stack).toHaveResource('AWS::Lambda::CodeSigningConfig', {
+ AllowedPublishers: {
+ SigningProfileVersionArns: [
+ {
+ 'Fn::GetAtt': [
+ 'SigningProfile1D4191686',
+ 'ProfileVersionArn',
+ ],
+ },
+ {
+ 'Fn::GetAtt': [
+ 'SigningProfile2E013C934',
+ 'ProfileVersionArn',
+ ],
+ },
+ {
+ 'Fn::GetAtt': [
+ 'SigningProfile3A38DE231',
+ 'ProfileVersionArn',
+ ],
+ },
+ ],
+ },
+ });
+ });
+
+ test('with description and with untrustedArtifactOnDeployment of "ENFORCE"', () => {
+ const platform = signer.Platform.AWS_LAMBDA_SHA384_ECDSA;
+ const signingProfile = new signer.SigningProfile(stack, 'SigningProfile', { platform });
+ new lambda.CodeSigningConfig(stack, 'CodeSigningConfig', {
+ signingProfiles: [signingProfile],
+ untrustedArtifactOnDeployment: lambda.UntrustedArtifactOnDeployment.ENFORCE,
+ description: 'test description',
+ });
+
+ expect(stack).toHaveResource('AWS::Lambda::CodeSigningConfig', {
+ CodeSigningPolicies: {
+ UntrustedArtifactOnDeployment: lambda.UntrustedArtifactOnDeployment.ENFORCE,
+ },
+ Description: 'test description',
+ });
+ });
+
+ test('import does not create any resources', () => {
+ const codeSigningConfigId = 'aaa-xxxxxxxxxx';
+ const codeSigningConfigArn = `arn:aws:lambda:::code-signing-config:${codeSigningConfigId}`;
+ const codeSigningConfig = lambda.CodeSigningConfig.fromCodeSigningConfigArn(stack, 'Imported', codeSigningConfigArn );
+
+ expect(codeSigningConfig.codeSigningConfigArn).toBe(codeSigningConfigArn);
+ expect(codeSigningConfig.codeSigningConfigId).toBe(codeSigningConfigId);
+ expect(stack).toCountResources('AWS::Lambda::CodeSigningConfig', 0);
+ });
+
+ test('fail import with malformed code signing config arn', () => {
+ const codeSigningConfigArn = 'arn:aws:lambda:::code-signing-config';
+
+ expect(() => lambda.CodeSigningConfig.fromCodeSigningConfigArn(stack, 'Imported', codeSigningConfigArn ) ).toThrow(/ARN must be in the format/);
+ });
+});

packages/@aws-cdk/aws-lambda/test/function.test.ts

@@ -9,6 +9,7 @@ import * as kms from '@aws-cdk/aws-kms';
 import * as logs from '@aws-cdk/aws-logs';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as sqs from '@aws-cdk/aws-sqs';
+import * as signer from '@aws-cdk/aws-signer';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as _ from 'lodash';
@@ -2003,6 +2004,36 @@ describe('function', () => {
  });
  });
  });
+
+ describe('code signing config', () => {
+ test('default', () => {
+ const stack = new cdk.Stack();
+
+ const signingProfile = new signer.SigningProfile(stack, 'SigningProfile', {
+ platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
+ });
+
+ const codeSigningConfig = new lambda.CodeSigningConfig(stack, 'CodeSigningConfig', {
+ signingProfiles: [signingProfile],
+ });
+
+ new lambda.Function(stack, 'MyLambda', {
+ code: new lambda.InlineCode('foo'),
+ handler: 'index.handler',
+ runtime: lambda.Runtime.NODEJS_10_X,
+ codeSigningConfig,
+ });
+
+ expect(stack).toHaveResource('AWS::Lambda::Function', {
+ CodeSigningConfigArn: {
+ 'Fn::GetAtt': [
+ 'CodeSigningConfigD8D41C10',
+ 'CodeSigningConfigArn',
+ ],
+ },
+ });
+ });
+ });
 });
 
 function newTestLambda(scope: constructs.Construct) {