getsentry / getsentry/sentry-javascript

Code sign the Sentry lambda layer to use in code signed lambdas

Abierto
#12,584 1 comentario 0 reacciones 0 asignados Ver en GitHub
AWS Lambda Improvement Meta: Help Wanted
Lenguaje dominante
TypeScript
Estrellas
8.7k
Forks
1.8k
Merge medio
1 d 17 h
PR fusionados (30 d)
515

Descripción

### Problem Statement

In updating our lambdas to take use lambda code-signing I've run into the issue that the Sentry lambda layer is not signed and therefore cannot be used in a code-signed lambda.

Please release a code-signed lambda and with it the version_arn of the signing profile so that we can use the lambda layer in code-signed lambdas.

### Solution Brainstorm

See here for reference: https://aws.amazon.com/blogs/security/best-practices-and-advanced-patterns-for-lambda-code-signing/

In particular if you scroll down to the section about using lambda layers in code-signed lambdas it is possible so long as the layer is signed and the code signing config includes the signing profile version arn of the publisher in the allowed publishers:

```
aws lambda create-code-signing-config \
--description "Allow layers from publisher" \
--allowed-publishers SigningProfileVersionArns="," \
--code-signing-policies "UntrustedArtifactOnDeployment"="Enforce"
```

In terraform we would have something like this:
```
resource "aws_signer_signing_profile" "signing" {
platform_id = "AWSLambda-SHA384-ECDSA"
}

resource "aws_lambda_code_signing_config" "signing" {
allowed_publishers {
signing_profile_version_arns = [
aws_signer_signing_profile.signing.version_arn,

]
}
policies {
untrusted_artifact_on_deployment = "Enforce"
}

depends_on = [aws_signer_signing_profile.signing]
}
```

On this page where you share the `arn` of the lambda layer, it could also include the `version_arn` of the signing profile: https://docs.sentry.io/platforms/javascript/guides/aws-lambda/layer/

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.