Feature request: Support for signed Lambda functions

[heitorlessa]

Use case

Originally stated by @jplock

When using code signing feature, any Lambda Layer must be also signed. This means customers using this feature can't use our public Lambda Layers, as it's not currently signed.

What's not clear yet is whether a signed Lambda Layer can be used by a non-signed Lambda function.

Solution/User Experience

Lambda Powertools for Python maintainers to create a Code Signing Profile, sign Lambda Layers, and share its ARN within the documentation.

Alternative solutions

Build my own Layer or use PyPi

Acknowledgment

• This feature request meets Lambda Powertools Tenets
• Should this be considered in other Lambda Powertools languages? i.e. Java, TypeScript

[am29d]

Just checked few configurations for (non- )signed layer/functions. The good news is that you can add a signed layer to a non-signed lambda function. But supporting signed layers will require to also publish the signing profiles ARNs and add documentation steps so customers can modify their lambda code signing configurations, and redeploy the functions.

Another topic to discuss is "Signature validity period" settings for the signer. The maximum period is 11 years. Whatever period we choose, the public layer can't be used if the code signer is configured with the "enforce" policy.

Overall I think this is a feature we should adopt in the future and sign all the layers to add extra security. Once we have the new layer publishing pipeline in place I will look into this feature request and see how we can reduce the overhead to support it.