Automate Lambda code signing with Amazon CodeCatalyst and AWS Signer

Amazon CodeCatalyst is an integrated service for software development teams adopting continuous integration and deployment practices into their software development process. CodeCatalyst puts the tools you need all in one place. You can plan work, collaborate on code build, test, and deploy applications with continuous integration/continuous delivery (CI/CD) tools. You can also integrate AWS resources with your projects by connecting your AWS accounts to your CodeCatalyst space. By managing all of the stages and aspects of your application lifecycle in one tool, you can deliver software quickly and confidently.

Introduction

In this post we will focus on how development teams can use Amazon CodeCatalyst with AWS Signer to fully manage the code signing process to ensure the trust and integrity of code assets. We will describe the process of building the AWS Lambda code using a CodeCatalyst workflow, we will then demonstrate the process of signing the code using a signer profile and deploying the signed code to our Lambda function.

Figure 1: Architecture Diagram.

Prerequisites

To follow along with the post, you will need the following items:

• An AWS Builder ID for signing in to CodeCatalyst.
• A CodeCatalyst space
• Have the Space administrator role assigned in your CodeCatalyst space
• Have an AWS account associated with your space along with an associated IAM role
• A CodeCatalyst project with a source repository
• A CodeCatalyst environment connected to an AWS account
• A CodeCatalyst IAM role associated with the target AWS account
• If you are using the CodeCatalystWorkflowDevelopmentRole-project_name you will need to add the relevant AWS Signer permissions. In our demo environment we used signer:* S3-*IAM permission.
• CDK v2 installed

Walkthrough

During this tutorial, we will create a step-by-step guide to constructing a workflow utilizing CodeCatalyst. The objective is to employ the AWS Signer service to retrieve Python code from a specified source Amazon S3 bucket, compress and sign the code, and subsequently store it in a destination S3 bucket. Finally, we will utilize the signed code to deploy a secure Lambda function.

Create the base workflow

To begin we will create our workflow in the CodeCatalyst project.

Select CI/CD → Workflows → Create workflow:

Figure 2: Create workflow.

Leave the defaults for the Source Repository and Branch, select Create. We will have an empty workflow:

Figure 3: Empty workflow.

We can edit the workflow from the CodeCatalyst console, or use a Dev Environment. Initially, we will create an initial commit of this workflow file, ignore any validation errors at this stage:

Figure 4: Commit workflow with workflow file name, message repository and branch name.

Connect to CodeCatalyst Dev Environment

We will use an AWS Cloud9 Dev Environment. Our first step is to connect to the dev environment.

Select Code → Dev Environments. If you do not already a Dev Instance you can create an instance by selecting Create Dev Environment.

Figure 5: Create Dev Environment.

We already have a Dev Environment, so will go ahead and select Resume Instance. A new browser tab opens for the IDE and will be available in less than one minute. Once the IDE is ready, we can go ahead and start building our workflow. First, open a terminal. You can then change into the source repository directory and pull the latest changes. In our example, our Git source repository name is lambda-signer

cd lambda-signer && git pull. We can now edit this file in our IDE.

Initially, we will create a basic Lambda code under artifacts directory:

mkdir artifacts
cat <<EOF > artifacts/index.py
def lambda_handler(event, context): print('Testing Lambda Code Signing using Signer') EOF

The previous command block creates our index.py file which will go inside the AWS Lambda function. When we testing the Lambda Function, we should see message “Testing Lambda Code Signing using Signer” in the console log.

As a next step, we will create the CDK directory and initiate it:

mkdir cdk;
cd cdk && cdk init --language python cdk

The previous command will create a directory called ‘cdk’ and then initiate cdk inside this directory. As a result, we will see another directory named ‘cdk’. We then need to update files inside this directory as per the following screenshot.

Figure 6: Repository file structure.

Update the content of the files as per the code following snippets:

(Note: Update your region name by replacing the placeholder <Region Name> )

cdk_stack.py:

import os
from constructs import Construct
from aws_cdk import ( Duration, Stack, aws_lambda as lambda_, aws_signer as signer, aws_s3 as s3, Aws as aws, CfnOutput
) class CdkStack(Stack): def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None: super().__init__(scope, construct_id, **kwargs) # Set the AWS region os.environ["AWS_DEFAULT_REGION"] = "<Region Name>" # Create the signer profile signer_profile_name = "my-signer-profile-" + aws.ACCOUNT_ID print(f"signer_profile_name: {signer_profile_name}") signing_profile = signer.SigningProfile(self, "SigningProfile", platform=signer.Platform.AWS_LAMBDA_SHA384_ECDSA, signing_profile_name='my-signer-profile' + aws.ACCOUNT_ID, signature_validity=Duration.days(365) ) self.code_signing_config = lambda_.CodeSigningConfig(self, "CodeSigningConfig", signing_profiles=[signing_profile] ) source_bucket_name = "source-signer-bucket-" + aws.ACCOUNT_ID source_bucket = s3.Bucket(self, "SourceBucket", bucket_name=source_bucket_name, block_public_access=s3.BlockPublicAccess.BLOCK_ALL, encryption=s3.BucketEncryption.S3_MANAGED, versioned=True ) destination_bucket_name = "dest-signer-bucket-" + aws.ACCOUNT_ID self.destination_bucket = s3.Bucket(self, "DestinationBucket", bucket_name=destination_bucket_name, block_public_access=s3.BlockPublicAccess.BLOCK_ALL, encryption=s3.BucketEncryption.S3_MANAGED, versioned=True ) resolved_signing_profile_name = self.resolve(signing_profile.signing_profile_name) CfnOutput(self,"signer-profile",value=signing_profile.signing_profile_name) CfnOutput(self,"src-bucket",value=source_bucket.bucket_name) CfnOutput(self,"dst-bucket",value=self.destination_bucket.bucket_name)

lambda_stack.py:

from constructs import Construct
from aws_cdk import ( Duration, Stack, aws_lambda as lambda_, aws_signer as signer, aws_s3 as s3, Aws as aws, CfnOutput
) class LambdaStack(Stack): def __init__(self, scope: Construct, construct_id: str, dst_bucket:s3.Bucket,codesigning_config: lambda_.CodeSigningConfig, **kwargs) -> None: super().__init__(scope, construct_id, **kwargs) # Set the AWS region # Get the code from action inputs bucket_name = self.node.try_get_context("bucket_name") key = self.node.try_get_context("key") lambda_function = lambda_.Function( self, "Function", function_name=’sample-signer-function’, code_signing_config=codesigning_config, runtime=lambda_.Runtime.PYTHON_3_9, handler="index.Lambda_handler", code=lambda_.Code.from_bucket(dst_bucket, key) )

app.py:

#!/usr/bin/env python3 import aws_cdk as cdk from cdk.cdk_stack import CdkStack
from cdk.lambda_stack import LambdaStack app = cdk.App()
signer_stack = CdkStack(app, "cdk")
lambda_stack = LambdaStack(app, "LambdaStack", dst_bucket=signer_stack.destination_bucket,codesigning_config=signer_stack.code_signing_config) app.synth()

Finally, we will work on Workflow:

In our example, our workflow is Workflow_d892. We will locate Workflow_d892.yaml in the .codecatalyst\workflows directory in our repository.

Figure 7: Workflow yaml file.

Update workflow with remaining steps

We can assign our workflow a name and configure the action. We have five stages in this workflow:

• CDKBootstrap: Prepare AWS Account for CDK deployment.
• CreateSignerResources: Deploys Signer resources into AWS Account
• ZipLambdaCode: Compresses the index.py file and store it in the source S3 bucket
• SignCode: Sign the compressed python file and push it to the destination S3 bucket
• Createlambda: Creates the Lambda Function using the signed code from destination S3 bucket.

Please insert the following values for your environment into the workflow file. The environment configuration will be as per the pre-requisite configuration for CodeCatalyst environment setup:

• <Name of your Environment>: The Name of your CodeCatalyst environment
• <AWS Account>: The AWS Account connection ID
• <Role Name>: The CodeCatalyst role that is configured for the environment

(Note: Feel free to update the region configuration to meet your deployment requirements. Supported regions are listed here)

Name: Workflow_d892
SchemaVersion: "1.0" # Optional - Set automatic triggers.
Triggers: - Type: Push Branches: - main # Required - Define action configurations.
Actions: CDKBootstrap: # Identifies the action. Do not modify this value. Identifier: aws/[email protected] # Specifies the source and/or artifacts to pass to the action as input. Inputs: # Optional Sources: - WorkflowSource # This specifies that the action requires this Workflow as a source # Required; You can use an environment, AWS account connection, and role to access AWS resources. Environment: Name: <Name of your Environment> Connections: - Name: <AWS Account> Role: <Role Name> # Defines the action's properties. Configuration: # Required; type: string; description: AWS region to bootstrap Region: <Region Name> CreateSignerResources: # Identifies the action. Do not modify this value. Identifier: aws/[email protected] DependsOn: - CDKBootstrap # Specifies the source and/or artifacts to pass to the action as input. Inputs: # Optional Sources: - WorkflowSource # This specifies that the action requires this Workflow as a source # Required; You can use an environment, AWS account connection, and role to access AWS resources. Environment: Name: <Name of your Environment> Connections: - Name: <AWS Account> Role: <Role Name> Configuration: # Required; type: string; description: Name of the stack to deploy StackName: cdk CdkRootPath: cdk Region: <Region Name> CfnOutputVariables: '["signerprofile","dstbucket","srcbucket"]' Context: '{"key": "placeholder"}' ZipLambdaCode: Identifier: aws/build@v1 DependsOn: - CreateSignerResources Inputs: Sources: - WorkflowSource Environment: Name: <Name of your Environment> Connections: - Name: <AWS Account> Role: <Role Name> # Configuration: Steps: - Run: sudo yum install zip -y - Run: cd artifacts && zip lambda-${WorkflowSource.CommitId}.zip index.py - Run: aws s3 cp lambda-${WorkflowSource.CommitId}.zip s3://${CreateSignerResources.srcbucket}/tobesigned/lambda-${WorkflowSource.CommitId}.zip - Run: S3VER=$(aws s3api list-object-versions --output text --bucket ${CreateSignerResources.srcbucket} --prefix 'tobesigned/lambda-${WorkflowSource.CommitId}.zip' --query 'Versions[*].VersionId') Outputs: Variables: - S3VER SignCode: Identifier: aws/build@v1 DependsOn: - ZipLambdaCode Inputs: Sources: - WorkflowSource Environment: Name: <Name of your Environment> Connections: - Name: AWS Account> Role: <Role Name> # Configuration: Steps: - Run: export AWS_REGION=<Region Name> - Run: SIGNER_JOB=$(aws signer start-signing-job --source --output text --query 'jobId' 's3={bucketName=${CreateSignerResources.srcbucket},key=tobesigned/lambda-${WorkflowSource.CommitId}.zip,version=${ZipLambdaCode.S3VER}}' --destination 's3={bucketName=${CreateSignerResources.dstbucket},prefix=signed-}' --profile-name ${CreateSignerResources.signerprofile}) Outputs: Variables: - SIGNER_JOB CreateLambda: # Identifies the action. Do not modify this value. Identifier: aws/[email protected] DependsOn: - SignCode # Specifies the source and/or artifacts to pass to the action as input. Inputs: # Optional Sources: - WorkflowSource # This specifies that the action requires this Workflow as a source # Required; You can use an environment, AWS account connection, and role to access AWS resources. Environment: Name: <Name of your Environment> Connections: - Name: AWS Account> Role: <Role Name> # Defines the action's properties. Configuration: # Required; type: string; description: Name of the stack to deploy StackName: LambdaStack CdkRootPath: cdk Region: <Region Name> Context: '{"key": "signed-${SignCode.SIGNER_JOB}.zip"}'

We can copy/paste this code into our workflow. To save our changes, we select File -> Save. We can then commit these to our git repository by typing the following at the terminal:

git add . && git commit -m ‘adding workflow’ && git push

The previous command will commit and push the changes that we have made to the CodeCatalyst source repository. As we have a branch trigger for main defined, this will trigger a run of the workflow. We can monitor the status of the workflow in the CodeCatalyst console by selecting CICD -> Workflows. Locate your workflow and click on Runs to view the status.

Figure 8: Successful workflow execution.

To validate that our newly created Lambda function is using AWS Signed code, we can open the AWS Console in our target region > Lambda > click on the sample-signer-function to inspect the properties.

Figure 9: AWS Lambda function with signed code.

Under the Code Source configuration property, you should see an informational message advising that ‘Your function has signed cofde and can’t be edited inline’. This confirms that the Lambda function is successfully using signed code.

Cleaning up

If you have been following along with this workflow, you should delete the resources that you have deployed to avoid further chargers. In the AWS Console > CloudFormation, locate the LambdaStack, then select and click Delete to remove the stack. Complete the same steps for the CDK stack.

Conclusion

In this post, we explained how development teams can easily get started signing code with AWS Signer and deploying it to Lambda Functions using Amazon CodeCatalyst. We outlined the stages in our workflow that enabled us to achieve the end-to-end release cycle. We also demonstrated how to enhance the developer experience of integrating CodeCatalyst with our AWS Cloud9 Dev Environment and leveraging the power of AWS CDK to use familiar programming languages such as Python to define our infrastructure as code resources.