aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
SigningProfile creation fails for platforms other than AWSLambda-SHA384-ECDSA
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Signer::SigningProfile
### Description
Creating a singing profile for a platform ID other than "AWSLambda-SHA384-ECDSA" fails with following message:
> Properties validation failed for resource MySigningProfile with message:
> #/PlatformId: # only 1 subschema matches out of 2
> #/PlatformId: failed validation constraint for keyword [enum]
While trying to dig into the issue, I've also tried to create a signing profile through the AWS CLI, providing the same parameters that CDK sets in the CloudFormation template. There the error message is a lot clearer
```
> aws signer put-signing-profile --profile-name test --platform-id AWSIoTDeviceManagement-SHA256-ECDSA
An error occurred (ValidationException) when calling the PutSigningProfile operation: signing material cannot be null.
```
It became clear to me that [CloudFormation](https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-resource-signer-signingprofile.html) doesn't provide a way to set the signing material. The signing material refers to the [AWS Certificate Manager certificate used for signing](https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html#signer-PutSigningProfile-request-signingMaterial). In my use case, I would have to additionally set the signing parameters which is also not supported through CloudFormation.
### Other Details
Workaround for the moment is to create the SigningProfile through the API or an AWS custom resource
Contributor guide
Research direction
Start by comparing the AWS::Signer::SigningProfile CloudFormation resource documentation with the AWS CLI PutSigningProfile request and its signingMaterial and signingParameters fields. Confirm which non-AWSLambda-SHA384-ECDSA platform IDs and inputs CloudFormation supports; done means the resource can create the reported profile without the validation or signing-material error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100