AWS lambda documentation change
Summary
Added note about container image limitations and clarified code signing configuration behavior
Security assessment
Documents security feature limitations and operational behavior without addressing specific vulnerabilities
Diff
diff --git a/lambda/latest/dg/configuration-codesigning-create.md b/lambda/latest/dg/configuration-codesigning-create.md index dc95b9d2b..90edc5e7e 100644 --- a//lambda/latest/dg/configuration-codesigning-create.md +++ b//lambda/latest/dg/configuration-codesigning-create.md @@ -10,0 +11,4 @@ To enable code signing for a function, you create a _code signing configuration_ +###### Note + +Functions defined as container images do not support code signing. + @@ -26,3 +30 @@ Before you can configure code signing for a Lambda function, use AWS Signer to d - * Create one or more signing profiles. - - * Use a signing profile to create a signed code package for your function. + * Create one or more [signing profiles](https://docs.aws.amazon.com/signer/latest/developerguide/signing-profiles.html). @@ -29,0 +32 @@ Before you can configure code signing for a Lambda function, use AWS Signer to d + * Use a signing profile to [create a signed code package for your function](https://docs.aws.amazon.com/signer/latest/developerguide/lambda-workflow.html). @@ -33 +35,0 @@ Before you can configure code signing for a Lambda function, use AWS Signer to d -For more information, see [Creating Signing Profiles (Console)](https://docs.aws.amazon.com/signer/latest/developerguide/ConsoleLambda.html) in the _AWS Signer Developer Guide_. @@ -62 +64,5 @@ A code signing configuration defines a list of allowed signing profiles and the -To enable code signing for a function, you associate a code signing configuration with the function. +To enable code signing for a function, add a code signing configuration to the function. + +###### Important + +Code signing configurations only prevent new deployments of unsigned code. If you add a code signing configuration to an existing function that has unsigned code, that code keeps running until you deploy a new code package. @@ -91 +97 @@ Code signing -Update configuration +Permissions