Lightning Talk: Knowing Your Serverless Functions: Signing and Verifying Serverless...
summary
Cosign and Sigstore integrate into CI/CD to sign serverless code and deployment artifacts, signatures and certs get stored in AWS KMS or secret storage, and a lightweight validator function triggers on CloudTrail+EventBridge events, computes the function hash, verifies the Cosign signature, and returns allow or block; an open source template and Lambda validator are published and work with traditional keypairs to minimize cold‑start impact while plans exist for Azure and GCP.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:32Open Source Foundation
- 0:59SixStory
- 2:02Why Serverless
- 3:53AWS Code Signing
- 4:39Alternative Approach
- 5:31Solution
- 7:31Conclusion
- 8:08Questions
related talks
30mSecurity in the Serverless Environment
40mServerless Architecture Security Patterns for Securing the Unseen
33mServerless Security: New Risks Require New Approaches
15mSupply chain security: AWS Signer for build attribution
50mAutomated Serverless Security Testing: Delivering secure apps continuously
24mServerless security: how to protect what you don't see?
18mSelf-service AWS Serverless Application Model
42mBlowing Up Serverless Security with IAM (And How to Avoid It)