aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

SigningProfile creation fails for platforms other than AWSLambda-SHA384-ECDSA

Open
#1,641 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Signer::SigningProfile

### Description

Creating a singing profile for a platform ID other than "AWSLambda-SHA384-ECDSA" fails with following message:

> Properties validation failed for resource MySigningProfile with message:
> #/PlatformId: # only 1 subschema matches out of 2
> #/PlatformId: failed validation constraint for keyword [enum]

While trying to dig into the issue, I've also tried to create a signing profile through the AWS CLI, providing the same parameters that CDK sets in the CloudFormation template. There the error message is a lot clearer

```
> aws signer put-signing-profile --profile-name test --platform-id AWSIoTDeviceManagement-SHA256-ECDSA

An error occurred (ValidationException) when calling the PutSigningProfile operation: signing material cannot be null.
```

It became clear to me that [CloudFormation](https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-resource-signer-signingprofile.html) doesn't provide a way to set the signing material. The signing material refers to the [AWS Certificate Manager certificate used for signing](https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html#signer-PutSigningProfile-request-signingMaterial). In my use case, I would have to additionally set the signing parameters which is also not supported through CloudFormation.

### Other Details

Workaround for the moment is to create the SigningProfile through the API or an AWS custom resource

Contributor guide

Open the contributing guide

Research direction

Start by comparing the AWS::Signer::SigningProfile CloudFormation resource documentation with the AWS CLI PutSigningProfile request and its signingMaterial and signingParameters fields. Confirm which non-AWSLambda-SHA384-ECDSA platform IDs and inputs CloudFormation supports; done means the resource can create the reported profile without the validation or signing-material error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.