AWS.Signer reference

DescribeSigningJob

Source: src/AWS/Signer/DescribeSigningJob.ts

Runtime binding for signer:DescribeSigningJob.

Reads a signing job by the jobId returned from StartSigningJob / SignPayload — its status (InProgress, Succeeded, Failed), the signed object’s S3 location, and the signature expiry. Account-level operation — job ids are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.DescribeSigningJobHttp).

DescribeSigningJob: Observing Signing Jobs

// init — account-level binding, no resource argument
const describeSigningJob = yield* AWS.Signer.DescribeSigningJob();

// runtime
const job = yield* describeSigningJob({ jobId });
const signedKey = job.signedObject?.s3?.key;

GetRevocationStatus

Source: src/AWS/Signer/GetRevocationStatus.ts

Runtime binding for signer:GetRevocationStatus.

Checks whether a signature’s signing profile version, signing job, or signing certificates have been revoked — the verification-time complement to RevokeSignature / RevokeSigningProfile, served from Signer’s regional verification (data-) endpoint. Account-level operation — the entities checked are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.GetRevocationStatusHttp).

GetRevocationStatus: Revoking Signatures

// init — account-level binding, no resource argument
const getRevocationStatus = yield* AWS.Signer.GetRevocationStatus();

// runtime
const { revokedEntities } = yield* getRevocationStatus({
  signatureTimestamp: signedAt,
  platformId: "Notation-OCI-SHA384-ECDSA",
  profileVersionArn,
  jobArn,
  certificateHashes,
});
const trusted = (revokedEntities ?? []).length === 0;

GetSigningPlatform

Source: src/AWS/Signer/GetSigningPlatform.ts

Runtime binding for signer:GetSigningPlatform.

Reads one AWS-managed signing platform by id — its signing configuration (encryption/hash algorithms), image format, size limit, and whether it supports revocation. Account-level operation over the AWS-managed platform catalog, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.GetSigningPlatformHttp).

GetSigningPlatform: Discovering Platforms

// init — account-level binding, no resource argument
const getSigningPlatform = yield* AWS.Signer.GetSigningPlatform();

// runtime
const platform = yield* getSigningPlatform({
  platformId: "AWSLambda-SHA384-ECDSA",
});
const canRevoke = platform.revocationSupported === true;

ListSigningJobs

Source: src/AWS/Signer/ListSigningJobs.ts

Runtime binding for signer:ListSigningJobs.

Lists the account’s signing jobs, filterable by status, platform, requester, revocation state, and signature expiry window. Account-level operation — the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.ListSigningJobsHttp).

ListSigningJobs: Observing Signing Jobs

// init — account-level binding, no resource argument
const listSigningJobs = yield* AWS.Signer.ListSigningJobs();

// runtime
const { jobs } = yield* listSigningJobs({ status: "InProgress" });

ListSigningPlatforms

Source: src/AWS/Signer/ListSigningPlatforms.ts

Runtime binding for signer:ListSigningPlatforms.

Lists the AWS-managed signing platforms (Lambda, Notation/OCI, IoT, FreeRTOS, …), filterable by category, partner, and target. Account-level operation over the AWS-managed platform catalog, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.ListSigningPlatformsHttp).

ListSigningPlatforms: Discovering Platforms

// init — account-level binding, no resource argument
const listSigningPlatforms = yield* AWS.Signer.ListSigningPlatforms();

// runtime
const { platforms } = yield* listSigningPlatforms();
const ids = (platforms ?? []).map((p) => p.platformId);

ProfilePermission

Source: src/AWS/Signer/ProfilePermission.ts

A cross-account permission on an AWS Signer signing profile — one statement in the profile’s resource policy granting another AWS account (or IAM identity) a Signer action such as signer:StartSigningJob. The Signer counterpart of CloudFormation’s AWS::Signer::ProfilePermission.

Permissions have no update API: changing the action, principal, or profileVersion converges by removing and re-adding the statement under the same statement id (revision-checked, so concurrent policy edits are retried); changing profileName or statementId replaces the permission.

ProfilePermission: Sharing a Signing Profile

Allow Another Account to Sign

const profile = yield* Signer.SigningProfile("ReleaseProfile", {
  platformId: "AWSLambda-SHA384-ECDSA",
});

const permission = yield* Signer.ProfilePermission("CiAccountCanSign", {
  profileName: profile.profileName,
  action: "signer:StartSigningJob",
  principal: "123456789012",
});

Pin the Permission to a Profile Version

const permission = yield* Signer.ProfilePermission("CiAccountCanSign", {
  profileName: profile.profileName,
  action: "signer:StartSigningJob",
  principal: "123456789012",
  profileVersion: profile.profileVersion,
});

RevokeSignature

Source: src/AWS/Signer/RevokeSignature.ts

Runtime binding for signer:RevokeSignature.

Permanently invalidates the signature produced by a single signing job — the surgical alternative to revoking a whole profile version when one artifact is compromised. Account-level operation — job ids are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Signer.RevokeSignatureHttp).

RevokeSignature: Revoking Signatures

// init — account-level binding, no resource argument
const revokeSignature = yield* AWS.Signer.RevokeSignature();

// runtime
yield* revokeSignature({ jobId, reason: "artifact compromised" });

RevokeSigningProfile

Source: src/AWS/Signer/RevokeSigningProfile.ts

Runtime binding for signer:RevokeSigningProfile.

Revokes a version of the bound SigningProfile, permanently invalidating every signature that version produced on or after effectiveTime — the incident-response lever when signing material is compromised. Revocation is irreversible. The profile name is injected from the binding; pass the profileVersion to revoke. Provide the implementation with Effect.provide(AWS.Signer.RevokeSigningProfileHttp).

RevokeSigningProfile: Revoking Signatures

// init — bind the operation to the profile
const revokeSigningProfile = yield* AWS.Signer.RevokeSigningProfile(profile);

// runtime — invalidate everything the version signed from now on
yield* revokeSigningProfile({
  profileVersion,
  reason: "signing key compromised",
  effectiveTime: new Date(),
});

SigningProfile

Source: src/AWS/Signer/SigningProfile.ts

An AWS Signer signing profile — a code-signing template (platform + signing material + signature validity) used to sign code, most commonly as the trust anchor for Lambda code signing configs.

PutSigningProfile is create-only in practice (re-putting an existing name fails with “Profile with name X already exists”), so every property except tags is immutable — changing one replaces the profile under a new generated name. On destroy the profile is canceled — AWS retains canceled profiles (the name stays reserved) and deletes them per its data-retention policy, so prefer generated names over fixed profileNames.

SigningProfile: Creating a Signing Profile

Lambda Code-Signing Profile

const profile = yield* Signer.SigningProfile("release-profile", {
  platformId: "AWSLambda-SHA384-ECDSA",
});

Profile with Signature Validity Period

const profile = yield* Signer.SigningProfile("release-profile", {
  platformId: "AWSLambda-SHA384-ECDSA",
  signatureValidityPeriod: { value: 12, type: "MONTHS" },
  tags: { team: "platform" },
});

SignPayload

Source: src/AWS/Signer/SignPayload.ts

Runtime binding for signer:SignPayload.

Signs a binary payload synchronously with the bound SigningProfile and returns the signature inline — the API behind Notation container-image signing (use a Notation-OCI-SHA384-ECDSA profile). The profile name is injected from the binding. Provide the implementation with Effect.provide(AWS.Signer.SignPayloadHttp).

SignPayload: Signing Code

// init — bind the operation to the Notation profile
const signPayload = yield* AWS.Signer.SignPayload(profile);

// runtime
const { jobId, signature } = yield* signPayload({
  payload: new TextEncoder().encode(JSON.stringify(notaryPayload)),
  payloadFormat: "application/vnd.cncf.notary.payload.v1+json",
});

StartSigningJob

Source: src/AWS/Signer/StartSigningJob.ts

Runtime binding for signer:StartSigningJob.

Starts an asynchronous code-signing job with the bound SigningProfile — Signer reads the (versioned) source object from S3, signs it with the profile’s platform and material, and writes the signed artifact to the destination bucket. The profile name is injected from the binding; the caller’s credentials are used for the S3 access, so also bind S3.GetObject on the source bucket and S3.PutObject on the destination. Returns the jobId for use with DescribeSigningJob / RevokeSignature. Provide the implementation with Effect.provide(AWS.Signer.StartSigningJobHttp).

StartSigningJob: Signing Code

// init — bind the operation to the profile
const startSigningJob = yield* AWS.Signer.StartSigningJob(profile);

// runtime
const { jobId } = yield* startSigningJob({
  source: { s3: { bucketName: "src", key: "code.zip", version: versionId } },
  destination: { s3: { bucketName: "dst", prefix: "signed/" } },
});