Skip to content
SPECIFICTION
Get listed

AWS Signer

aws.amazon.com

Free plan WebWindowsmacOSLinuxAPI
Visit aws.amazon.com
Spec score 9.1 #1 of 28 in Code Signing Software

What it is

AWS Signer is a managed code-signing service for verifying code integrity and publisher trust. It supports signing AWS Lambda deployment packages, code for supported IoT devices, and OCI container images using Notation. Lambda verifies signatures and package integrity when signed code is deployed. For containers, Signer works with Notation in registries such as Amazon ECR, with signatures stored alongside images for verification.

Administrators control access to Signer resources and actions through AWS Identity and Access Management policies. Signing profiles can be managed in the Signer console, AWS CLI, or API. Signer manages certificates and keys for Lambda and container workflows; IoT workflows can use a code-signing certificate imported into AWS Certificate Manager. Documentation also lists integrations with AWS Certificate Manager and CloudTrail, plus Amazon EKS image verification. Notation CLI and Signer plugin installers are listed for Linux, macOS, and Windows. API actions have per-second quotas by account and Region, with no minimum request rate. Use with specified AWS services has no additional charge, though related charges may apply.

Spec sheet

What it does
AWS Signer is a fully managed service that digitally signs code so recipients can check integrity and publisher identity.Read 15 Oct 2026 · docs.aws.amazon.com
Purpose
AWS Signer is a fully managed code-signing service that helps verify code integrity and publisher trust.Read 4 Oct 2026 · docs.aws.amazon.com
Access controls
Administrators use AWS Identity and Access Management policies to control which users, groups, and roles can access Signer resources and actions.Read 4 Oct 2026 · docs.aws.amazon.com
API quotas
API actions have per-second quotas by AWS account and Region, and AWS Signer does not offer a minimum API request rate.Read 4 Oct 2026 · docs.aws.amazon.com
API throttling
Signer applies adjustable per-account, per-Region requests-per-second quotas and offers no minimum API request rate.Read 15 Oct 2026 · docs.aws.amazon.com
AWS integrations
Documented integrations include Amazon S3, Amazon CloudWatch, AWS CloudTrail, AWS Certificate Manager, ECR, EKS, Lambda, IoT Device Management and FreeRTOS.Read 15 Oct 2026 · docs.aws.amazon.com
AWS launch
AWS says it launched Amazon Web Services in spring 2006.Read 4 Oct 2026 · aws.amazon.com
Certificate management
Signer manages signing certificates and keys for Lambda and container image workflows; IoT workflows can use a code-signing certificate imported into AWS Certificate Manager.Read 4 Oct 2026 · docs.aws.amazon.com
CLI and documentation
AWS publishes a Developer Guide, API Reference and AWS CLI reference for Signer.Read 15 Oct 2026 · docs.aws.amazon.com
Company founding and size
LinkedIn lists AWS as founded in 2006 with more than 10,001 employees.Read 15 Oct 2026 · linkedin.com
Company identity
Amazon Web Services is listed as a public IT services and consulting company headquartered in Seattle, Washington.Read 15 Oct 2026 · linkedin.com
Container integration
Signer works with Notation to sign container images in registries such as Amazon ECR, with signatures stored alongside images for verification.Read 4 Oct 2026 · docs.aws.amazon.com
Container signing
Signer works with the Notation CLI to sign OCI images in registries such as Amazon ECR, storing signatures alongside images.Read 15 Oct 2026 · docs.aws.amazon.com
Container-image announcement
AWS announced ECR and EKS container-image signing with Signer on June 6, 2023, including key rotation, audit logs and revocation.Read 15 Oct 2026 · aws.amazon.com
Cross-account signing
Cross-account signing is supported for Lambda and container-registry platforms, with profile owners granting permissions to other accounts.Read 15 Oct 2026 · docs.aws.amazon.com
Download platforms
The Notation CLI and Signer plugin installers are listed for Linux, macOS, and Microsoft Windows.Read 4 Oct 2026 · docs.aws.amazon.com
EKS verification
Amazon EKS and self-managed Kubernetes clusters can verify ownership and integrity of signed container images during deployment.Read 15 Oct 2026 · docs.aws.amazon.com
Installer contents
Installers bundle Notation, the Signer plugin, trust stores and root certificates, configurable trust policy and license files.Read 15 Oct 2026 · docs.aws.amazon.com
Installer requirements
The Notation and Signer plugin installers support Linux RPM/Debian on x86_64 and arm64, macOS on x86_64 and arm64, and Windows x86_64.Read 15 Oct 2026 · docs.aws.amazon.com
IoT signing
It signs firmware for supported IoT devices, including Amazon FreeRTOS and AWS IoT Device Management, using a certificate imported into AWS Certificate Manager.Read 15 Oct 2026 · docs.aws.amazon.com
Lambda integration
AWS Lambda verifies signatures and package integrity when signed code is deployed.Read 4 Oct 2026 · docs.aws.amazon.com
Lambda signing
It signs AWS Lambda deployment packages stored in Amazon S3 using signing profiles.Read 15 Oct 2026 · docs.aws.amazon.com
Lambda verification
Lambda can warn about or reject deployments when signatures or package integrity checks fail.Read 15 Oct 2026 · aws.amazon.com
Launch history
AWS documentation records the original AWS Signer launch on December 20, 2017.Read 15 Oct 2026 · docs.aws.amazon.com
Limit: attestations
Red Team reports no support for arbitrary SBOM, vulnerability or SLSA provenance attestations.Read 15 Oct 2026 · red-team.sh
Limit: AWS lock-in
Red Team warns that Notation signatures reduce portability because verification depends on AWS-specific tooling and formats.Read 15 Oct 2026 · red-team.sh
Limit: Kubernetes integration
Red Team says Kubernetes admission-controller integration is less direct than Cosign and requires additional configuration.Read 15 Oct 2026 · red-team.sh
Limit: no keyless signing
Red Team reports that Signer does not provide keyless signing; AWS manages keys but keys still exist.Read 15 Oct 2026 · red-team.sh
Limit: no transparency log
Red Team notes that Signer has no public transparency log, with CloudTrail providing only account-local audit records.Read 15 Oct 2026 · red-team.sh
Limit: operational complexity
Safeguard reports that teams often get stuck on the operational details of production ECR signing and recommends Cosign for multi-cloud or transparency requirements.Read 15 Oct 2026 · safeguard.sh
Managed key lifecycle
Signer centrally manages code-signing certificates, public keys, private keys and their lifecycle settings.Read 15 Oct 2026 · docs.aws.amazon.com
Other integrations
AWS Signer documentation lists integrations with AWS Certificate Manager and CloudTrail, as well as Amazon EKS image verification.Read 4 Oct 2026 · docs.aws.amazon.com
Platform types
Documented platform IDs cover AWS IoT Device Management, Amazon FreeRTOS variants, AWS Lambda and Notation OCI signing.Read 15 Oct 2026 · docs.aws.amazon.com
Plugin licence
AWS open-sourced its Notation plugin under Apache 2.0 as a Go library and CLI executable; the managed Signer service remains cloud-hosted.Read 15 Oct 2026 · aws.amazon.com
Praise: ease and value
A DEV Community tutorial characterizes Signer setup as easy, cheaper and secure, showing an example with zero Signer cost.Read 15 Oct 2026 · dev.to
Public API
The API exposes operations including PutSigningProfile, StartSigningJob, SignPayload, revocation, profile permissions, tagging and listing methods.Read 15 Oct 2026 · docs.aws.amazon.com
Rating on Gartner Peer Insights (AWS overall)
4.6 out of 5 from 4,741 reviewsRead 15 Oct 2026 · gartner.com
Regional endpoints
Signer provides regional IPv4, dual-stack and FIPS endpoints across numerous commercial and GovCloud Regions.Read 15 Oct 2026 · docs.aws.amazon.com
Retention limits
Canceled or revoked profiles and signing jobs are retained for defined periods, including validity plus six months for many profiles and six months after signature expiry for jobs.Read 15 Oct 2026 · docs.aws.amazon.com
SDK support
The AWS JavaScript SDK exposes Signer methods such as putSigningProfile, startSigningJob, signPayload and revokeSignature.Read 15 Oct 2026 · docs.aws.amazon.com
Security model
AWS describes Signer security under a shared-responsibility model in which AWS secures cloud infrastructure and customers secure their configurations and data.Read 15 Oct 2026 · docs.aws.amazon.com
Signing profiles
Signing profiles define the target platform and signing parameters and can be created through the console, CLI or API.Read 15 Oct 2026 · docs.aws.amazon.com
Signing workflows
It supports signing AWS Lambda deployment packages, code for supported IoT devices, and container images using Notation.Read 4 Oct 2026 · docs.aws.amazon.com
Validity period
Lambda and container signing profiles default to a 135-month signature validity period, which can be configured.Read 15 Oct 2026 · docs.aws.amazon.com
Who it is for
AWS describes Lambda signing as a way for organizations to define trusted publishers and let authorized developers generate certified code packages.Read 4 Oct 2026 · docs.aws.amazon.com

Plans and prices

AWS Signer Free No additional charge for use with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS, or third-party container services. Related service charges may apply · Lambda use may incur Amazon S3 storage charges for signed and unsigned objects Read 4 Oct 2026 · docs.aws.amazon.com
AWS Signer usage with supported AWS services Free No additional charge with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS or third-party container services Related service charges may apply · Lambda signing can incur Amazon S3 storage charges Read 15 Oct 2026 · docs.aws.amazon.com

Every AWS Signer plan and price →

Strong points and limits

Strong points

  • Supports Lambda, IoT, and OCI container signing.
  • Lambda verifies signatures when signed code is deployed.
  • Container signatures are stored alongside images.
  • Manages certificates and keys for Lambda and container workflows.
  • No additional charge with specified AWS services.

Limits

  • Related service charges may apply.
  • Lambda use may incur Amazon S3 storage charges.
  • API actions have per-second account and Region quotas.
  • No minimum API request rate is offered.

Who it suits

It suits organizations signing Lambda packages, supported IoT code, or OCI container images and defining trusted publishers. Administrators can manage access with IAM policies and signing profiles through the console, CLI, or API.

AWS Signer in depth

Read the full write-up

AWS Signer is a managed service for establishing publisher trust and checking software integrity. It is best suited to organizations deploying Lambda functions, supported IoT firmware, or OCI containers through AWS. The main trade-off is a focused AWS-centered scope paired with account- and Region-level API quotas.

Overview

Signer brings code signing into three deployment paths: AWS Lambda packages, firmware for supported IoT devices and FreeRTOS, and OCI container images. It is a particularly sensible fit when those workloads already use AWS services and need signing without operating their own certificate and key infrastructure.

The service is less compelling as a general-purpose signing platform. Its targets are defined rather than open-ended, and AWS provides no minimum API request rate. Workloads that require broad artifact coverage or guaranteed request capacity should look beyond Signer.

Key features

Lambda verifies a package's signature and integrity when signed code is deployed. That makes signing part of the deployment control point, useful for organizations defining trusted publishers and allowing authorized developers to produce certified packages.

For containers, Signer works with the Notation CLI and plugin. Signatures sit alongside images in registries such as Amazon ECR, allowing image verification in the registry workflow; AWS also documents Amazon EKS image-verification integration. IoT workflows cover supported devices and FreeRTOS firmware images.

Administrators govern users, groups and roles with AWS Identity and Access Management policies, so access to Signer resources and actions can follow existing AWS permission structures. Signing profiles are created and managed in the Signer console, AWS CLI or API, giving both console-oriented teams and automated pipelines a workable administration route.

Signer manages signing certificates and keys for Lambda and container-image workflows. IoT signing can use a code-signing certificate imported into AWS Certificate Manager. AWS documentation also lists integrations with Certificate Manager and CloudTrail, extending certificate handling and activity visibility within the AWS environment.

The Notation CLI and Signer plugin installers are provided for Linux, macOS and Microsoft Windows. Signer itself is exposed through web, API and those desktop operating environments, with Linux and Windows also relevant to command-line automation.

API actions are subject to per-second quotas by AWS account and Region. Because no minimum request rate is offered, high-volume or burst-sensitive automation needs quota planning and should not assume a guaranteed baseline.

Pricing

AWS Signer — free (billed). There is no additional charge when used with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS or third-party container services. This is a service-specific free arrangement rather than a promise that the surrounding workflow costs nothing: related service charges may apply, and Lambda use may incur Amazon S3 storage charges for signed and unsigned objects.

That pricing suits AWS customers who want managed signing for the supported targets without a separate Signer line item. It gives up the predictability of an all-inclusive bill because storage and other connected services remain chargeable. The published terms do not add a seat allowance, trial period or renewal schedule; the practical limits called out are the per-account, per-Region API quotas.

Platforms

Signer supports web and API access, with Linux, macOS and Windows installers for the Notation CLI and Signer plugin. The supported signing targets are AWS Lambda deployment packages, IoT and FreeRTOS firmware images, and OCI containers.

Who it's for

Choose Signer when your organization needs trusted publishers and deployment-time verification across Lambda, supported IoT devices or containers, particularly when IAM, CloudTrail, ECR or EKS already anchor your operations. It is also a good match for teams that want AWS to handle certificates and keys for Lambda and container workflows.

It is a weaker choice for teams seeking a self-hosted signer, unrestricted artifact types or a guaranteed API capacity floor. Those requirements point toward tools with different hosting and licensing models.

Pros and cons

Pros

Coverage across AWS workloads: Lambda, supported IoT and FreeRTOS firmware, and OCI containers share one managed signing service.

Deployment-aware verification: Lambda checks signature and package integrity at deployment, while Notation keeps container signatures beside images for verification.

AWS-native control: IAM policies, console/CLI/API profile management, Certificate Manager and CloudTrail fit established AWS administration.

No additional Signer charge for named services: qualifying Lambda, IoT Device Management, ECR, EKS and third-party container use avoids a separate Signer fee.

Cons

Defined target set: the service is not presented as a universal signer for arbitrary software artifacts.

Quota uncertainty: per-account, per-Region per-second quotas apply and no minimum API request rate is offered.

Connected-service costs remain: related charges can apply, including S3 storage for Lambda's signed and unsigned objects.

IoT certificate arrangement differs: IoT workflows use a code-signing certificate imported into AWS Certificate Manager rather than the managed certificate-and-key path described for Lambda and containers.

Alternatives

For a broader starting point, browse Code Signing Software.

SignServer is the better fit when you want a freemium, self-hosted option with basic code, document and container signing plus timestamping.

OpenPubkey suits teams wanting an Apache 2.0 open-source reference implementation rather than an AWS-managed service.

SignPath is aimed at eligible open-source projects through its free Open Source Code Signing plan.

Cosign is preferable when a free, open-source signing tool with no hosted service or stated usage limits is the priority.

Aujas Automated Code Signing Platform offers several signing-based licenses with pay-as-use pricing.

DigiCert Software Trust Manager is an alternative paid platform with custom pricing.

Notation is the direct free Apache 2.0 CLI choice when you need container signing without Signer's managed service.

CyberArk Code Sign Manager - Self-Hosted is for organizations seeking a paid self-hosted deployment.

Verdict

AWS Signer is the right choice for AWS-centered teams signing Lambda, supported IoT firmware and OCI containers who value IAM-controlled access and managed certificate handling. Choose it for that integrated workflow and its lack of an additional Signer charge with named AWS services. Look elsewhere if you need broad artifact coverage, self-hosting or a guaranteed API request rate.

Verdict

AWS Signer covers code signing across Lambda, supported IoT devices, and OCI containers, with access controls and certificate management. It has no additional charge with specified AWS services, but related charges and API quotas are worth noting.

Where Specifiction places it

Alternatives to AWS SignerAll alternatives →