Built in code signing as part of module to support prepared zips

[Fran-Rg]

Is your request related to a new offering from AWS?

• Yes ✅: please list the AWS provider version which introduced this functionality
  All visible on https://github.com/terraform-aws-modules/terraform-aws-lambda/blob/master/examples/code-signing/main.tf#L55

Is your request related to a problem? Please describe.

To support code signing with this module it's required to pre-zip and upload the file to s3. This causes an issue when we rely on the packaging happening within the module as the zip is produced within the module and can't be signed.

Describe the solution you'd like.

Add a aws_signer_signing_job resource with expected variables:

• [required] enable code signing
• [required] signing profile_name
• [optional] destination s3 prefix otherwise use the same as var.s3_prefix
• [optional] destination s3 bucket otherwise use the same bucket as var.s3_bucket

Describe alternatives you've considered.

I tried to use the output module.this.s3_object.bucket to sign it and inject it to the s3_existing_package but that creates a looping dependency.

Additional context

Checkov rates code signing as a high finding: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

[antonbabenko]

You are right, there is an example of how to do it, but we currently don't have a submodule that can handle it. We may create it in the future.

[Fran-Rg]

@antonbabenko I've raised a PR to support code signing: #660

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

[github-actions]

This issue was automatically closed because of stale in 10 days