Feature/eli 702 code signing by TOEL2 · Pull Request #617 · NHSDigital/eligibility-signposting-api

TOEL2 · 2026-03-25T21:10:29Z

Description

Implements code signing for test env and beyond - we only need to sign once and then that signed object is passed through

Context

increases security

Type of changes

Refactoring (non-breaking change)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would change existing functionality)
Bug fix (non-breaking change which fixes an issue)

Checklist

I am familiar with the contributing guidelines
I have followed the code style of the project
I have added tests to cover my changes
I have updated the documentation accordingly
This PR is a result of pair or mob programming

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

Copilot

Pull request overview

Adds AWS Lambda code signing to improve deployment security by signing the built Lambda zip and enforcing signed-only deployments in higher environments.

Changes:

Adds AWS Signer signing profile + Lambda Code Signing Config in the Lambda Terraform module and conditionally attaches it in test/preprod/prod.
Introduces a “sign artifact” job in the TEST deployment workflow to sign the Lambda zip via AWS Signer before Terraform apply.
Extends IAM policies/boundaries to allow GitHub Actions (and developers) to manage code signing resources.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf	Expands developer permissions boundary to include Signer + Lambda code signing actions
infrastructure/stacks/iams-developer-roles/github_actions_policies.tf	Adds a GitHub Actions IAM policy for managing code signing and Signer operations
infrastructure/modules/lambda/signing.tf	Creates AWS Signer signing profile and Lambda code signing config; exports profile name
infrastructure/modules/lambda/locals.tf	Adds env-gated toggle for enabling Lambda code signing attachment
infrastructure/modules/lambda/lambda.tf	Attaches code signing config ARN to the Lambda function when enabled
.github/workflows/cicd-3-test-deploy.yaml	Adds signing job in TEST pipeline; deploy job consumes signed artifact

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

infrastructure/modules/lambda/signing.tf

infrastructure/modules/lambda/lambda.tf

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

infrastructure/modules/lambda/signing.tf

Copilot · 2026-03-25T23:06:50Z

.github/workflows/cicd-3-test-deploy.yaml

+      - name: "Extract S3 bucket name from Terraform output"
+        id: tf_output
+        run: |
+          BUCKET=$(terraform output -raw lambda_artifact_bucket)
+          PROFILE=$(terraform output -raw lambda_signing_profile_name)
+          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
+          echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
+        working-directory: ./infrastructure/stacks/api-layer


This step runs terraform output -raw lambda_signing_profile_name, but the api-layer stack currently doesn’t define an output "lambda_signing_profile_name" (only lambda_artifact_bucket exists in infrastructure/stacks/api-layer/s3_buckets.tf). As a result, this workflow will fail here. Expose the module output from the stack (or avoid relying on a Terraform output by deriving/standardising the profile name).

Copilot · 2026-03-25T23:06:50Z

.github/workflows/cicd-3-test-deploy.yaml

+        run: |
+          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
+          make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
+        working-directory: ./infrastructure


The signing job depends on a signing profile that must already exist in the target AWS account/state before this workflow runs (it only does init + output). On the first deployment after introducing these Terraform resources, the profile/config won’t exist yet, so signing will fail before the workflow reaches the later terraform apply that would create them. Consider a bootstrap path (e.g. create signing profile/config in a prior step/stack, or handle missing outputs by applying the signing resources first).

Suggested change

working-directory: ./infrastructure

working-directory: ./infrastructure/stacks/api-layer

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

TOEL2 · 2026-03-30T11:36:10Z

After we agreed to split this up into two tickets, I have disabled the signing requirement on the lambda simply by un-linking the signing config arn from the lambda definition using a variable and left comments for the next step. I have also removed the workflow changes and put them in another workflow that we can activate once we have the required resources.

In effect this pr will make changes to our infrastructure but no functional changes to the api or the ci/cd pipeline, just sets us up to do that on a subsequent pr.

eddalmond1 · 2026-03-31T10:00:53Z

infrastructure/modules/lambda/signing.tf

+  description = "Only allow Lambda bundles signed by our trusted signer profile"
+}
+
+output "lambda_signing_profile_name" {


this might need to be added to outputs.tf in the module, then potentially re-output in the stack (in infrastructure/stacks/api-layer/lambda.tf ?)

eddalmond1 · 2026-03-31T10:03:23Z

.github/workflows/cicd-3-test-deploy-updated.yaml

+          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
+          make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
+        working-directory: ./infrastructure
+


I'm not clear on intention here - no apply step, which would presumably block, unless the intention is to run the other workflow, to deploy the codesigning infra, then ths to test it out / turn it on?

its to get the outputs from the init so that we can use them in the signing step below (120)

then once we have a signed lambda we can do the next job in this workflow - deploy which does the tf apply

eddalmond1 · 2026-03-31T10:04:32Z

.github/workflows/cicd-3-test-deploy-updated.yaml

+        with:
+          terraform_version: ${{ needs.metadata.outputs.terraform_version }}
+
+      - name: "Configure AWS Credentials"


Likewise (to below comment), this should still have the iams roles deployment

eddalmond1 · 2026-03-31T10:06:34Z

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

+          "signer:CancelSigningProfile",
+          "signer:RevokeSignature"
+        ],
+        Resource = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/eligibility-signposting-api-*"


The resource gets a name like 'EligibilityApiLambdaSigningProfile'

e.g. line 2 of signing.tf:

"${terraform.workspace}"}EligibilityApiLambdaSigningProfile"

yeah oversight there, changed it in one place and not the other - will fix

eddalmond1 · 2026-03-31T10:09:12Z

.github/workflows/cicd-3-test-deploy-updated.yaml

+          echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
+        working-directory: ./infrastructure/stacks/api-layer
+
+      - name: "Upload unsigned lambda artifact to S3"


I'm wondering now whether each environment will need to sign, as we're using separate accounts (so Prod has no reason to trust PreProd etc....)

TOEL2 added 8 commits March 25, 2026 19:58

[ELI-702] - adding the new signing resources and attaching to lambda

3b31922

[ELI-702] - changing workflow to sign and upload first before deployment

272126c

[ELI-702] - expanding github role permissions with new policy

f4e1924

[ELI-702] - changing name to something valid

2153103

[ELI-702] - excepting for dev

d55e992

[ELI-702] - adding permissions

0fda371

[ELI-702] - adding permissions

358dc0c

[ELI-702] - restricting permissions

3ad3203

TOEL2 requested a review from Copilot March 25, 2026 22:59

Copilot started reviewing on behalf of TOEL2 March 25, 2026 23:00 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

TOEL2 added 7 commits March 26, 2026 16:22

[ELI-702] - removing suppression

5fb9a3b

[ELI-702] - swapping env for workspace

41eca6d

Merge branch 'main' into feature/ELI-702-code-signing

2c460bd

[ELI-702] - swapping arn to all for config actions

afa6788

Merge branch 'main' into feature/ELI-702-code-signing

a94fdc0

[ELI-702] - disabling signing enforcement for now

a383695

[ELI-702] - checkov suppression

c9d8c2a

github-advanced-security bot found potential problems Mar 30, 2026

View reviewed changes

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf Dismissed Show dismissed Hide dismissed

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf Dismissed Show dismissed Hide dismissed

TOEL2 added 2 commits March 30, 2026 12:29

[ELI-702] - removing workflow changes for now

4e61c0c

Merge branch 'main' into feature/ELI-702-code-signing

cbba2ef

Merge branch 'main' into feature/ELI-702-code-signing

9bf8b61

eddalmond1 reviewed Mar 31, 2026

View reviewed changes

	working-directory: ./infrastructure
	working-directory: ./infrastructure/stacks/api-layer

Conversation

TOEL2 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Context

Type of changes

Checklist

Sensitive Information Declaration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TOEL2 commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eddalmond1 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

eddalmond1 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

TOEL2 Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TOEL2 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

eddalmond1 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

eddalmond1 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

TOEL2 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

eddalmond1 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TOEL2 commented Mar 25, 2026 •

edited

Loading

TOEL2 commented Mar 30, 2026 •

edited

Loading

TOEL2 Mar 31, 2026 •

edited

Loading