sample-aws-lambda-code-signing-terraform/lambda_signer.tf at main · aws-samples/sample-aws-lambda-code-signing-terraform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Generate a random string to use as a suffix
#https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string
resource "random_string" "suffix" {
  length  = 8
  special = false
  upper   = false
}

#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/signer_signing_profile
resource "aws_signer_signing_profile" "lambda_signing_profile" {
  platform_id = "AWSLambda-SHA384-ECDSA"
  name        = "${replace(var.name, "-", "_")}_lambda_signing_profile_${random_string.suffix.result}"
  signature_validity_period {
    value = 135
    type  = "MONTHS"
  }
}

#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_code_signing_config
resource "aws_lambda_code_signing_config" "configuration" {
  allowed_publishers {
    signing_profile_version_arns = [aws_signer_signing_profile.lambda_signing_profile.version_arn]
  }

  policies {
    untrusted_artifact_on_deployment = "Enforce"
  }
  description = "Code signing configuration for ${var.name} Lambda function."
}

#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/signer_signing_job
resource "aws_signer_signing_job" "build_signing_job" {
  profile_name = aws_signer_signing_profile.lambda_signing_profile.name
  source {
    s3 {
      bucket  = aws_s3_bucket.lambda_source.bucket
      key     = aws_s3_object.lambda_zip.key
      version = aws_s3_object.lambda_zip.version_id
    }
  }
  destination {
    s3 {
      bucket = aws_s3_bucket.lambda_source.bucket
      prefix = "signed/"
    }
  }
  depends_on = [aws_s3_bucket_versioning.lambda_source, aws_s3_object.lambda_zip]
}