aws / aws/aws-cdk

(signer): not working for signing platforms other than AWSLambda-SHA384-ECDSA

Open
#25,332 2 comments 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-signer effort/medium feature-request needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

Trying to create a signing profile for platform _"AmazonFreeRTOS-Default"_ or _"AWSIoTDeviceManagement-SHA256-ECDSA"_ fails with CDK L2 and L1 constructs.

### Expected Behavior

A signing profile for platform _"AmazonFreeRTOS-Default"_ or _"AWSIoTDeviceManagement-SHA256-ECDSA"_ has been created.

### Current Behavior

Creating a singing profile for a platform ID other than _"AWSLambda-SHA384-ECDSA"_ fails with following message:

> Properties validation failed for resource MySigningProfile with message:
> #/PlatformId: # only 1 subschema matches out of 2
> #/PlatformId: failed validation constraint for keyword [enum]

### Reproduction Steps

import * as signer from 'aws-cdk-lib/aws-signer';

// neither of the provided snippets work. Not L2 and also not L1
const signingProfile = new signer.SigningProfile(this, 'SigningProfile', {
platform: signer.Platform.AMAZON_FREE_RTOS_DEFAULT,
});

const cfnSigningProfile = new signer.CfnSigningProfile(this, 'MyCfnSigningProfile', {
platformId: 'AmazonFreeRTOS-Default',
});

### Possible Solution

Unfortunately it seems there is no solution until CloudFormation supports all signing platforms. Still, I believe this issue is valuable as I spent days to figure out why `cdk deploy` fails before realizing that the issue is not on my side.

reference: https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1641

### Additional Information/Context

While trying to dig into the issue, I've also tried to create a signing profile through the AWS CLI, providing the same parameters that CDK sets in the CloudFormation template. There the error message is a lot clearer

```
> aws signer put-signing-profile --profile-name test --platform-id AWSIoTDeviceManagement-SHA256-ECDSA

An error occurred (ValidationException) when calling the PutSigningProfile operation: signing material cannot be null.
```

It became clear to me that [CloudFormation](https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-resource-signer-signingprofile.html) and thereby also CDK don't provide a way to set the signing material. The signing material refers to the [AWS Certificate Manager certificate used for signing](https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html#signer-PutSigningProfile-request-signingMaterial). In my use case, I would have to additionally set the signing parameters which is also not supported through CloudFormation.

### CDK CLI Version

2.73.0

### Framework Version

_No response_

### Node.js Version

18.12.1

### OS

macOS Ventura 13.3.1

### Language

Typescript

### Language Version

_No response_

### Other information

The only way that I could find to create a signing profile with CDK was to resort to `AWSCustomResources`

``` typescript
import { Platform } from 'aws-cdk-lib/aws-signer'
import {
AwsCustomResource,
AwsCustomResourcePolicy,
PhysicalResourceId,
} from 'aws-cdk-lib/custom-resources'

new AwsCustomResource(this, 'SingingProfileCustomResource', {
onCreate: {
service: 'Signer',
action: 'putSigningProfile',
parameters: {
profileName: 'MySigningProfile',
platformId: Platform.AMAZON_FREE_RTOS_DEFAULT.platformId,
signingMaterial: {
certificateArn: 'arn:aws:acm:eu-central-1:01234567890:certificate/abcd-efgh-ijkkl-pqerst'
},
signingParameters: {
my: 'parameters'
},
},
physicalResourceId: PhysicalResourceId.of('AwsCustomResourceSigningProfile'),
},
policy: AwsCustomResourcePolicy.fromSdkCalls({
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
}),
installLatestAwsSdk: true,
})
```

Contributor guide

Open the contributing guide

Research direction

Start with the aws-signer SigningProfile and CfnSigningProfile examples in the issue, then compare their CloudFormation properties with the AWS CLI PutSigningProfile request and the linked CloudFormation coverage issue. Done would require a supported way to provide signingMaterial and signingParameters for the listed platforms, or documentation that the limitation remains external to CDK.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.