Lambda code signing using Serverless Framework.

serverless.yml

# See: https://alsmola.medium.com/github-actions-signing-lambda-code-5b7444299b
# See: https://blog.awsfundamentals.com/serverless-framework-resource-extensions

service: code-signing-demo

provider:
  name: aws
  runtime: nodejs18.x
  architecture: arm64
  stage: ${opt:stage, 'prod'}
  region: ${opt:region, 'eu-north-1'}
  memorySize: ${opt:memory, 256}
  timeout: 10
  logRetentionInDays: 7

package:
  individually: true

functions:
  Greeter:
    handler: src/handler.handler
    description: Greeting demo
    events:
      - httpApi:
          method: GET
          path: /greet

resources:
  Resources:
    SigningProfile:
      Type: AWS::Signer::SigningProfile
      Properties:
        PlatformId: AWSLambda-SHA384-ECDSA
    CodesignedFunctionConfig:
      Type: AWS::Lambda::CodeSigningConfig
      Properties:
        Description: "Code signing demo"
        AllowedPublishers:
          SigningProfileVersionArns:
            - "Fn::GetAtt":
              - SigningProfile
              - Arn
        CodeSigningPolicies:
          UntrustedArtifactOnDeployment: "Enforce"

  # Comment this out the first time; then redeploy with this uncommented once the signing profile exists
  extensions:
    # Note the naming convention!
    GreeterLambdaFunction:
      Properties:
        CodeSigningConfigArn:
          "Fn::GetAtt":
            - CodesignedFunctionConfig
            - CodeSigningConfigArn