The problem

Software supply-chain attacks target the path from commit to production: poisoned dependencies, tampered images, skipped scans. Government and regulated buyers now ask for SBOMs and signed artifacts. This pipeline makes those properties automatic and impossible to bypass.

What you’ll build

• A CodePipeline V2 with a build/scan/sign stage and a separate verify stage
• Syft SBOM (SPDX) for every image, archived to an evidence bucket
• A Grype vulnerability gate that fails the build at HIGH or above, before the image reaches ECR
• AWS Signer + Notation signatures on the immutable image digest, then strict verification
• An ECR repo with immutable tags, KMS, scan-on-push and optional Inspector continuous scanning
• A Kyverno policy so EKS refuses unsigned images at admission

Architecture

source.zip ─▶ CodePipeline V2
               ├─ BuildScanSign (CodeBuild, privileged)
               │    docker build ─▶ syft SBOM ─▶ grype --fail-on high ─▶ push (immutable tag)
               │    ─▶ notation sign <digest> with AWS Signer ─▶ SBOM to evidence bucket
               └─ VerifySignature (CodeBuild)
                    notation verify <digest> against trust policy (strict)  ─▶  ready to deploy
EKS admission: kubernetes/kyverno-verify-aws-signer.yaml blocks unsigned images at runtime
ECR: scan-on-push + (optional) Amazon Inspector continuous rescans

AWS services used

How it works

1. BuildDocker builds from source with OCI revision labels.
2. InventorySyft produces the SBOM, so you always know what’s inside.
3. GateGrype scans the SBOM. Known-vulnerable images never get pushed.
4. Sign & verifyNotation signs the digest with AWS Signer, and a separate stage verifies against a strict trust policy.

Key design decisions

• Buildspecs live in the platform’s CDK code, not the app repo, so app teams can’t delete a gate.
• Signing the digest, not the tag, means a re-tag can’t smuggle in a different image.
• A distroless, non-root base image keeps the CVE count, and the noise, low.

Deploy it

npm install
npx cdk deploy
# optional account-wide continuous scanning + stricter gate:
npx cdk deploy -c enhancedScanning=true -c failOnSeverity=medium

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Switch the Dockerfile to an old base image and push. The pipeline fails at the gate with a table of HIGH/CRITICAL CVEs, and nothing reaches the registry.

Skills this demonstrates