Question

A financial services company builds internal Lambda functions and shared libraries used across dozens of AWS accounts. Recent industry incidents involving compromised open-source dependencies have prompted the security team to reduce software supply chain risk. They want to (1) ensure developers pull third-party packages only from an approved, versioned internal repository that proxies public registries, and (2) guarantee that only Lambda code artifacts signed by the organization's build pipeline can be deployed to production functions. Which combination of AWS services best meets these requirements?

Accepted Answer

Use AWS CodeArtifact as an upstream proxy for public package repositories, and configure AWS Signer with Lambda code signing configurations that reject unsigned or invalidly signed deployment packages.

Answer

Use Amazon S3 with object versioning to store all packages and enable S3 Object Lock, then use a Lambda layer to validate hashes at runtime.

Answer

Use AWS CodeArtifact for package management and enable Amazon Inspector code scanning to block deployment of any Lambda package that contains a vulnerability.

Answer

Use AWS Config rules to detect Lambda functions deployed from unapproved repositories and AWS Secrets Manager to store signing keys for the build pipeline.