ProfilePermission

Source: src/AWS/Signer/ProfilePermission.ts

A cross-account permission on an AWS Signer signing profile — one statement in the profile’s resource policy granting another AWS account (or IAM identity) a Signer action such as signer:StartSigningJob. The Signer counterpart of CloudFormation’s AWS::Signer::ProfilePermission.

Permissions have no update API: changing the action, principal, or profileVersion converges by removing and re-adding the statement under the same statement id (revision-checked, so concurrent policy edits are retried); changing profileName or statementId replaces the permission.

Sharing a Signing Profile

Allow Another Account to Sign

const profile = yield* Signer.SigningProfile("ReleaseProfile", {
  platformId: "AWSLambda-SHA384-ECDSA",
});

const permission = yield* Signer.ProfilePermission("CiAccountCanSign", {
  profileName: profile.profileName,
  action: "signer:StartSigningJob",
  principal: "123456789012",
});

Pin the Permission to a Profile Version

const permission = yield* Signer.ProfilePermission("CiAccountCanSign", {
  profileName: profile.profileName,
  action: "signer:StartSigningJob",
  principal: "123456789012",
  profileVersion: profile.profileVersion,
});