ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Attaching a code-signing configuration to the Lambda function and signing each deployment package with AWS Signer fulfills the policy. AWS Signer hashes the entire ZIP file, creates a digital signature with the signing profile's private key, and stores that signature with the package. When the package is deployed, Lambda automatically verifies the signature against the trusted signing profile specified in the code-signing configuration and rejects the deployment if validation fails, satisfying the requirement to block tampered code without extra infrastructure or scripts.

Enabling SSE-KMS on the S3 bucket does provide cryptographic integrity for objects while they are stored and detects corruption of the encrypted data, but it does not prove the code originated from an authorized source or prevent an attacker with upload permissions from replacing the object with a different, freshly encrypted file-so Lambda would still accept malicious code. S3 Object Lock prevents overwrites and deletions but lacks any cryptographic assurance of code authenticity. Storing checksums in custom metadata could detect tampering, but you would need to build and operate scripts to calculate, store, and verify the hashes, contrary to the requirement to avoid custom tooling.