AWS Signer

AWS Signer is a managed service for signing Lambda packages, supported IoT firmware, and OCI container images. It is best suited to organizations already operating on AWS that need publisher controls across those deployment paths. The trade-off is a service tied to AWS targets, account-and-Region API quotas, and related AWS charges.

Overview

Signer’s main value is combining cloud signing with AWS-native verification. Lambda can check a package’s signature and integrity when signed code is deployed, while container signatures can sit beside images in registries such as Amazon ECR for later verification. That makes it more useful for controlled release pipelines than for general-purpose signing outside these ecosystems.

Its scope is deliberate: AWS Lambda deployment packages, supported IoT and FreeRTOS firmware images, and OCI containers are the supported targets. Teams with broader artifact types or a requirement for guaranteed API capacity may find the service restrictive, since AWS assigns per-second quotas by account and Region and provides no minimum request rate.

Key features

Signing and verification

Signer handles Lambda packages, code for supported IoT devices, and container images through Notation. Lambda’s deployment-time verification connects signing directly to an execution control, rather than leaving integrity checks as a separate manual step. With containers, Notation stores signatures alongside images, including in Amazon ECR, so registries can retain the verification material with the artifact.

Identity and administration

AWS Identity and Access Management policies let administrators decide which users, groups, and roles may use Signer resources and actions. Signing profiles can be created and managed in the console, through the AWS CLI, or by API, giving operations teams a choice between graphical administration and automation.

Certificates and integrations

Signer manages signing certificates and keys for Lambda and container workflows. IoT workflows can use an imported code-signing certificate in AWS Certificate Manager. AWS also documents integrations with CloudTrail and Amazon EKS image verification, extending oversight and container admission workflows beyond the signing operation itself.

Pricing

AWS Signer — free (billed with no additional charge for use with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS, or third-party container services). Related service charges may apply. Lambda use may incur Amazon S3 storage charges for signed and unsigned objects.

This free Signer plan is the natural fit for teams already paying for the surrounding AWS services and wanting managed signing without a separate Signer usage fee. It is not an all-in cost promise: storage and other related services remain chargeable, so high-volume Lambda or container operations still need a broader AWS cost review. No seats, trial period, renewal term, or free-plan request cap is stated for Signer; API actions remain subject to account-and-Region per-second quotas.

Platforms

The service is delivered through an API and web-based AWS environment and supports Linux, macOS, and Windows tooling. Notation CLI and Signer plugin installers are provided for those three desktop platforms, allowing container-signing workflows to run from common developer and build environments.

Who it's for

AWS Signer fits organizations that deploy Lambda functions, supported IoT or FreeRTOS firmware, or OCI containers and want AWS-managed certificates, keys, and access policy. AWS positions Lambda signing for organizations defining trusted publishers while allowing authorized developers to generate certified packages. It is a strong match when IAM governance and AWS-native verification matter more than portability.

It is less suitable when signing must cover unrelated software formats, run independently of AWS, or depend on a guaranteed baseline of API requests per second. In those cases, a self-hosted or vendor-neutral signing tool may provide a better operational boundary.

Pros and cons

Pros

• Native deployment checks: Lambda verifies signatures and package integrity at deployment, giving signed artifacts a direct place in release control.
• Three relevant target types: Lambda, supported IoT/FreeRTOS firmware, and OCI containers cover several common AWS delivery paths.
• Managed key handling: AWS manages certificates and keys for Lambda and container workflows, reducing separate key-operations work.
• IAM governance: Policies can restrict Signer actions by user, group, and role.
• No additional Signer charge in stated integrations: Use with IoT Device Management, Lambda, ECR, EKS, and third-party container services carries no additional Signer fee.

Cons

• AWS-centered scope: Supported targets are defined AWS and OCI workflows, not a universal signing system.
• Quota variability: Per-second account-and-Region quotas apply, with no minimum API request rate.
• Related costs remain: Lambda signing can add Amazon S3 storage charges, and other AWS service charges may apply.
• IoT certificate responsibility differs: IoT workflows can require importing a code-signing certificate into AWS Certificate Manager.

Alternatives

For a broader directory of options, see Code Signing Software.

Cosign is a free, open-source option with no hosted service or usage limits stated; choose it when self-managed tooling is preferable to AWS integration.

OpenPubkey is a free Apache 2.0 reference implementation for teams wanting an open-source, self-hosted approach.

SignPath offers free open-source code signing subject to eligibility conditions, making it relevant to qualifying open-source projects.

SignServer provides a free Community plan with basic code, document, and container signing plus timestamping through source or container deployment.

Notation is a free Apache 2.0 CLI project for teams that need the container-signing component without adopting the full AWS service.

Sigstore is free for developers and software providers who want a broader open ecosystem.

Aujas Automated Code Signing Platform uses pay-as-use signing-based licenses.

DigiCert Software Trust Manager is a paid alternative with custom pricing.

Verdict

Choose AWS Signer if your release paths are Lambda, supported IoT firmware, or OCI containers and you want AWS-managed signing tied to IAM and deployment verification. Look elsewhere when portability, wider artifact coverage, self-hosting, or predictable API capacity is the priority.