Exam AWS Certified Security - Specialty topic 1 question 354 discussion

Check this https://aws.amazon.com/blogs/security/best-practices-and-advanced-patterns-for-lambda-code-signing/

Signer works on zip files. No need to encrypt the code, therefore I believe C is incorrect.

A -> Create and Zip file and B -> AWS Signer The two tasks works. C -> while valid does not seem to supported by any AWS documentation

AWS Signer can be used to sign the zipped Lambda function, which will encrypt the code package and add a signature to it. This signature can then be used by Lambda to verify the integrity of the code package when it is deployed. Option C cannot be the answer.

https://aws.amazon.com/blogs/security/best-practices-and-advanced-patterns-for-lambda-code-signing/#:~:text=code%20analysis%20controls.-,Basic%20pattern%3A,-Figure%202%20shows "The basic code signing pattern uses AWS Signer on a ZIP file and calls a create API to install the signed artifact in Lambda."

A+B easy one..

Need to validate that the code has not been altered before invocation, therefore A and B are the correct choices.

Current Answer is AB. Upload the lambda code in a zipped format to S3 bucket is one of the requirement for Lambda code signing. Encryption is not an requirement for code signing. So 'C' could not be the answer.

Selected BC

https://aws.amazon.com/blogs/security/best-practices-and-advanced-patterns-for-lambda-code-signing/ https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html

AB - signer needs a zipline plus there is no ask to encrypt

B : code signing for authenticity and integrity C : kms - symmetric/HMAC for verifying integrity

BC agree

BC - To verify code integrity, use AWS Signer to create digitally signed code packages for functions and layers. When a user attempts to deploy a code package, Lambda performs validation checks on the code package before accepting the deployment. Because code signing validation checks run at deployment time, there is no performance impact on function execution. https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html and Encrypt - With a KMS key to sign and verify.