What is AWS Signer?
AWS Signer is a fully managed code-signing service that ensures the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and comes from a trusted publisher.
Security administrators define the signing environment in one place: which IAM role can sign code and in which Regions. AWS Signer manages the code-signing certificate’s public and private keys and enables central management of the code-signing lifecycle. Integration with AWS CloudTrail records who generated code signatures.
Core capabilities
- Signing profiles: Central definition of the trusted publisher along with permitted IAM roles and Regions
- Managed keys: AWS Signer manages the code-signing certificate keys across the full lifecycle
- Lambda integration: Signed deployment packages; AWS Lambda verifies signatures and package integrity when code is deployed
- Container signing: Image signing through the Notary Project Notation CLI, signatures stored in the registry, verification in Amazon EKS
- IoT signing: Signing of firmware images for Amazon FreeRTOS and AWS IoT Device Management, including over-the-air updates
- Traceability: All API calls recorded through AWS CloudTrail
Typical use cases
Securing serverless applications: Authorized developers generate certified code packages through a signing profile. Lambda only runs code whose signature and package integrity have been verified.
Container software supply chain: Images are signed, the signature is stored alongside the image in the registry, and it is verified at deployment time in Amazon EKS or self-managed Kubernetes on EC2.
IoT devices and firmware: Firmware images for microcontrollers are signed before initial manufacture and before over-the-air updates, to rule out tampered updates.
Benefits
- Central definition and enforcement of the signing environment instead of scattered key handling
- No need to operate your own key management for the code-signing certificate
- Traceability through CloudTrail for compliance evidence
- No additional charge when used with Lambda, ECR, EKS and IoT Device Management
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS Signer: building signing profiles and role models, integrating signing into CI/CD pipelines for Lambda and containers, and verifying signed images in Amazon EKS.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is AWS Signer?
AWS Signer is a fully managed code-signing service that ensures the trust and integrity of your code. Organizations validate code against a digital signature to confirm that the code is unaltered and from a trusted publisher.
What can AWS Signer sign?
AWS Signer integrates with AWS Lambda, Amazon FreeRTOS and AWS IoT Device Management, Amazon ECR, Amazon EKS and AWS Certificate Manager. You use it to sign Lambda deployment packages, container images in a registry, and firmware images for microcontrollers and over-the-air updates.
Who manages the signing keys?
AWS Signer manages the code-signing certificate's public and private keys and enables central management of the code-signing lifecycle. Security administrators define in a signing profile which IAM role may sign code and in which Regions.
How much does AWS Signer cost?
AWS states there is no additional charge to use AWS Signer with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS or third-party container services. Charges for the related services still apply, for example Amazon S3 storage for signed and unsigned objects.
How are container images signed?
Together with the Notation CLI from the Notary Project, AWS Signer signs container images stored in a registry such as Amazon ECR. The signatures are stored in the registry alongside the images, where they are available for verifying image authenticity and integrity.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.