cis-aws-compute-12-8

name	cis-aws-compute-12.8
description	Ensure that Code Signing is enabled for Lambda functions
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","lambda","serverless","code-signing","integrity","supply-chain"]
cis_id	12.8
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-12.9","cis-aws-compute-12.11"]
prerequisites	[]
severity_boost	{}

Ensure that Code Signing is enabled for Lambda functions

Description

Ensure that all your Amazon Lambda functions are configured to use the Code Signing feature in order to restrict the deployment of unverified code.

Rationale

Code Signing, ensures that the function code is signed by an approved (trusted) source, and that it has not been altered since signing, and that the code signature has not expired or been revoked.

Impact

Enabling code signing adds an additional step to the deployment process. All code packages must be signed before deployment, which may slow down CI/CD pipelines.

Audit Procedure

Using AWS Console

1. Login to the AWS console using https://console.aws.amazon.com/lambda/
2. In the left column, under AWS Lambda, click Functions.
3. Under Function name click on the name of the function that you want to review.
4. Click the Configuration tab
5. Under General configuration on the left column, click Code signing.
6. Under the Code signing configuration section check for any code signing configurations created for the function.
7. If there are no code signing configurations available or listed is not enabled, refer to the remediation.
8. Repeat steps 2-7 for each Lambda function within the current region.
9. Then repeat the Audit process for all other regions.

Using AWS CLI

1. Run aws lambda list-functions

aws lambda list-functions --output table --query "Functions[*].FunctionName"

This command will provide a table titled ListFunctions

2. Run aws lambda get-function-code-signing-config

aws lambda get-function-code-signing-config --function-name "name_of_function" --query "CodeSigningConfigArn"

3. The command output should return an array with the requested ARN(s).
4. If the get-function-code-signing-config command output returns null, there are no code signing configurations for the Lambda function.
5. Refer to the remediation below.
6. Repeat step 2-5 for each Lambda function available in the selected AWS region.
7. Perform the Audit process for all other regions used.