This repo is an example of using AWS Codepipeline and CodeBuild to sign and verify a docker image with Sigstore's cosign.

Terraform creates all the AWS Resources necessary to run the Codepipeline.

• Codepipeline
  • S3 Bucket
  • IAM Role
  • IAM Role Policy
• AWS Codecommit Repo
• CodeBuild Project
  • IAM Role
  • S3 Bucket
  • Cloudwatch Log Group and Steam
• ECR - Container Repository
• KMS - Asymmetric key used for cosign key signing

Create an S3 bucket for Terraform remote state storage, this will have to be unique.

aws s3 mb s3://cosign-aws-codepipeline

Initialize Terraform

make tf_init

Create the Terraform plan

make tf_plan

Apply the changes

make tf_apply

Push this code repo to the AWS Codecommit repo by creating a new remote

git remote add aws $AWS_CODE_COMMIT_REPO

git push aws main

This should kick off the codepipeline and codebuild Terraform creates