(signer): not working for signing platforms other than AWSLambda-SHA384-ECDSA
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
Trying to create a signing profile for platform _"AmazonFreeRTOS-Default"_ or _"AWSIoTDeviceManagement-SHA256-ECDSA"_ fails with CDK L2 and L1 constructs.
### Expected Behavior
A signing profile for platform _"AmazonFreeRTOS-Default"_ or _"AWSIoTDeviceManagement-SHA256-ECDSA"_ has been created.
### Current Behavior
Creating a singing profile for a platform ID other than _"AWSLambda-SHA384-ECDSA"_ fails with following message:
> Properties validation failed for resource MySigningProfile with message:
> #/PlatformId: # only 1 subschema matches out of 2
> #/PlatformId: failed validation constraint for keyword [enum]
### Reproduction Steps
import * as signer from 'aws-cdk-lib/aws-signer';
// neither of the provided snippets work. Not L2 and also not L1
const signingProfile = new signer.SigningProfile(this, 'SigningProfile', {
platform: signer.Platform.AMAZON_FREE_RTOS_DEFAULT,
});
const cfnSigningProfile = new signer.CfnSigningProfile(this, 'MyCfnSigningProfile', {
platformId: 'AmazonFreeRTOS-Default',
});
### Possible Solution
Unfortunately it seems there is no solution until CloudFormation supports all signing platforms. Still, I believe this issue is valuable as I spent days to figure out why `cdk deploy` fails before realizing that the issue is not on my side.
reference: https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1641
### Additional Information/Context
While trying to dig into the issue, I've also tried to create a signing profile through the AWS CLI, providing the same parameters that CDK sets in the CloudFormation template. There the error message is a lot clearer
```
> aws signer put-signing-profile --profile-name test --platform-id AWSIoTDeviceManagement-SHA256-ECDSA
An error occurred (ValidationException) when calling the PutSigningProfile operation: signing material cannot be null.
```
It became clear to me that [CloudFormation](https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-resource-signer-signingprofile.html) and thereby also CDK don't provide a way to set the signing material. The signing material refers to the [AWS Certificate Manager certificate used for signing](https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html#signer-PutSigningProfile-request-signingMaterial). In my use case, I would have to additionally set the signing parameters which is also not supported through CloudFormation.
### CDK CLI Version
2.73.0
### Framework Version
_No response_
### Node.js Version
18.12.1
### OS
macOS Ventura 13.3.1
### Language
Typescript
### Language Version
_No response_
### Other information
The only way that I could find to create a signing profile with CDK was to resort to `AWSCustomResources`
``` typescript
import { Platform } from 'aws-cdk-lib/aws-signer'
import {
AwsCustomResource,
AwsCustomResourcePolicy,
PhysicalResourceId,
} from 'aws-cdk-lib/custom-resources'
new AwsCustomResource(this, 'SingingProfileCustomResource', {
onCreate: {
service: 'Signer',
action: 'putSigningProfile',
parameters: {
profileName: 'MySigningProfile',
platformId: Platform.AMAZON_FREE_RTOS_DEFAULT.platformId,
signingMaterial: {
certificateArn: 'arn:aws:acm:eu-central-1:01234567890:certificate/abcd-efgh-ijkkl-pqerst'
},
signingParameters: {
my: 'parameters'
},
},
physicalResourceId: PhysicalResourceId.of('AwsCustomResourceSigningProfile'),
},
policy: AwsCustomResourcePolicy.fromSdkCalls({
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
}),
installLatestAwsSdk: true,
})
```
Contributor guide
Research direction
Start with the aws-signer SigningProfile and CfnSigningProfile examples in the issue, then compare their CloudFormation properties with the AWS CLI PutSigningProfile request and the linked CloudFormation coverage issue. Done would require a supported way to provide signingMaterial and signingParameters for the listed platforms, or documentation that the limitation remains external to CDK.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100