用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-8命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-compute-12.8 |
| description | Ensure that Code Signing is enabled for Lambda functions |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","code-signing","integrity","supply-chain"] |
| cis_id | 12.8 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.9","cis-aws-compute-12.11"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that all your Amazon Lambda functions are configured to use the Code Signing feature in order to restrict the deployment of unverified code.
Code Signing, ensures that the function code is signed by an approved (trusted) source, and that it has not been altered since signing, and that the code signature has not expired or been revoked.
Enabling code signing adds an additional step to the deployment process. All code packages must be signed before deployment, which may slow down CI/CD pipelines.
AWS Lambda, click Functions.Function name click on the name of the function that you want to review.Configuration tabCode signing.Code signing configuration section check for any code signing configurations created for the function.aws lambda list-functionsaws lambda list-functions --output table --query "Functions[*].FunctionName"
This command will provide a table titled ListFunctions
aws lambda get-function-code-signing-configaws lambda get-function-code-signing-config --function-name "name_of_function" --query "CodeSigningConfigArn"
Each Lambda function has a code signing configuration with a valid CodeSigningConfigArn associated.
Create Signing Profile if none are set up. If you already have some created in the left panel click on Signing Profiles, Create Signing Profile.
***Note a Signing Profile is a trusted publisher and is analogous to the use of a digital signing certificate to generate signatures for your application code.Create Signing Profile setup page provide:
Create ProfileCode signing configurations.Create configurationCreate code signing configuration setup page:
Signing profile version ARN box and select the Signing Profile created above.Signature validation policy, click the signature validation policy suitable for your Lambda function.
**Note - A signature check can fail if the code is not signed by an allowed Signing Profile, or if the signature has expired or has been revoked.Create configurationEdit code signing, select the code signing configuration created above from the drop downSaveThe Lambda function is now configured to use code signing.
N/A - This control is Console-based remediation only.
Code Signing is not enabled by default for Lambda functions.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 2.7 Allowlist Authorized Scripts - Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently. | x | ||
| v8 | 10.2 Configure Automatic Anti-Malware Signature Updates - Configure automatic updates for anti-malware signature files on all enterprise assets. | x | x | x |
| v7 | 5.3 Securely Store Master Images - Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible. | x | x | |
| v7 | 8.2 Ensure Anti-Malware Software and Signatures are Updated - Ensure that the organization's anti-malware software updates its scanning engine and signature database on a regular basis. | x | x | x |
Level 1 | Manual