A company is concerned that a malicious user could deploy unauthorized changes to the code...

Requirement Summary:

Preventunauthorized code changesin AWS Lambda

Ensureonly trusted codeis deployed

✅AWS Lambda supports Code Signing:

You can configurecode signingin Lambda usingAWS Signer

Packages must bedigitally signedandverified against the signing profile

Rejects unauthorized/modified packages automatically

Evaluate Options:

A. Trusted code option in CodeDeploy

❌No such feature exists for Lambda

CodeDeploy is more forEC2/On-Prem/Containers, not Lambda code signing

✅B. Define code signing config + use AWS Signer

✅This isexactly how AWS enforces trusted code deployment

Attach acode signing configurationto the Lambda function

UseAWS Signerto digitally sign deployment packages

C. Link to KMS to sign code

❌KMS is not used tosign Lambda packages

KMS is fordata encryption, not application code integrity

D. Set KmsKeyArn

❌This configuresdata encryption, not code signing

Lambda code signing:https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html

AWS Signer overview:https://docs.aws.amazon.com/signer/latest/developerguide/what-is-signer.html