AWS Signer

Overview

AWS Signer is a managed code-signing service for teams that need to establish publisher trust and verify software integrity across AWS Lambda, supported IoT devices, and container images. It suits organizations already building or deploying in AWS; its strongest case is signing across those workflows while AWS manages certificates and keys for Lambda and containers.

The service is focused rather than universal: it supports defined AWS and OCI targets, and its API quotas have no guaranteed minimum request rate. Teams that need other signing workflows or predictable API capacity should weigh those constraints before choosing it.

Key features

Signer covers three distinct deployment paths: Lambda deployment packages, code for supported IoT devices, and OCI container images through Notation. Lambda checks signatures and package integrity when signed code is deployed, making signing relevant to the deployment gate rather than merely an archive step. For containers, Notation signatures are stored alongside images in registries such as Amazon ECR, where they can be verified.

Administrators can use AWS Identity and Access Management policies to control which users, groups, and roles access Signer resources and actions. Signing profiles are managed through the console, CLI, or API, giving teams multiple ways to fit profile administration into their AWS operations. Signer manages certificates and keys for Lambda and container image signing; IoT signing can instead use a code-signing certificate imported into AWS Certificate Manager.

Documented integrations include AWS Certificate Manager and CloudTrail, as well as Amazon EKS image verification. The Notation CLI and Signer plugin installers are offered for Linux, macOS, and Windows. API actions are subject to per-second quotas by account and Region, with no minimum request rate, so workloads sensitive to request availability need to plan around that limit.

Pricing

AWS Signer: free. There is no additional charge for use with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS, or third-party container services. Related service charges may apply; Lambda use may incur Amazon S3 storage charges for signed and unsigned objects. The free price makes it practical to use Signer with these services without a separate Signer usage charge, but it does not remove costs from related services.

The free plan is most suitable for teams whose signing needs fit these supported services and targets. The plan information gives no seat count or separate free-plan request allowance; API quotas apply by account and Region regardless. AWS Signer is also a paid pricing model, so readers should account for possible related service charges rather than treating the listed no-additional-charge use as an all-in cost.

Platforms

AWS Signer is offered across API, Linux, macOS, web, and Windows. The downloadable Notation CLI and Signer plugins support Linux, macOS, and Windows. Its supported targets are AWS Lambda deployment packages, IoT and FreeRTOS firmware images, and OCI containers; platform availability should not be mistaken for support for every code-signing target.

Who it's for

Signer is a strong fit for organizations that want to define trusted publishers for Lambda and let authorized developers generate certified code packages. It also suits AWS teams signing supported IoT firmware or container images that need signatures verifiable alongside their images. It is less compelling for teams whose targets fall outside these workflows or whose API-dependent process requires a guaranteed minimum request rate.

Pros and cons

• Pros: One managed service supports Lambda, IoT, and container signing, with managed certificates and keys for Lambda and containers.
• Pros: Lambda deployment verification and signatures stored beside container images connect signing to deployment and image verification workflows.
• Pros: IAM policies, signing profiles, and console, CLI, and API management give AWS teams control over access and operations.
• Cons: Per-second API quotas vary by account and Region, and there is no minimum request rate; that is a meaningful constraint for workloads that depend on steady API capacity.
• Cons: IoT workflows require a code-signing certificate imported into AWS Certificate Manager, unlike the managed certificate and key handling for Lambda and containers.
• Cons: Related service charges can still apply, including possible S3 storage charges for Lambda's signed and unsigned objects.

Alternatives

Cosign is a better fit for teams seeking free, open-source software without a hosted service or stated usage limits, rather than Signer's managed AWS integrations. SignPath is worth considering for eligible open-source projects looking for its free Open Source Code Signing plan.

SignServer offers a free Community plan for basic code, document, and container signing and timestamping, with source-code or container deployment. Sigstore is another free option for developers and software providers who want a service free to use.

SignPath Foundation may suit eligible, actively maintained open-source projects with an OSI-approved license that can meet its release conditions. DigiCert Software Trust Manager is an alternative with custom pricing. Bamboo Deploy may fit teams that want a broader deployment product; its Premium plan costs $15 a month, billed $45 every 3 months, and includes up to 50 apps and 1GB cloud hosting. Red Hat Trusted Artifact Signer is another paid alternative.

Browse more options in Code Signing Software.

Verdict

Choose AWS Signer if your organization needs managed signing and verification for Lambda, supported IoT devices, or OCI containers in AWS, especially when deployment checks and IAM-controlled access matter. The managed certificate handling and integration across those targets are its clearest advantages. Look elsewhere if you need broader signing targets or dependable minimum API capacity, and budget for related AWS service charges even when Signer itself adds no charge for the listed services.