Hi everyone,

I would like to ask a question about how I can deploy my signed Lambda package, which is triggered by S3 events (e.g., whenever an s3:ObjectCreated:* event occurs in an existing bucket).

Context:

• I use AWS Signer to sign the Lambda package before deployment.
• My deployment process:
  1. Run serverless package to generate the artifact.
  2. Upload the artifact to an S3 bucket.
  3. Use aws signer start-signing-job to sign the package.
  4. Download the signed package and replace the .serverless directory's artifact.
  5. Deploy the signed package using serverless deploy --package .serverless.

Problem:

When defining the S3 event trigger in serverless.yml, the framework creates a Custom Resource Lambda via CloudFormation. This additional Lambda function is not compatible with signed packages, causing the deployment to fail with the following error:

"Lambda cannot deploy the function. The function or layer might be signed using a signature that the client is not configured to accept."

Workarounds Tried:

• Setting existing: false for the S3 trigger.
  • This creates a new bucket, but I need to use an existing bucket.
• Manually adding permissions and S3 notification configuration using AWS CLI.
  • While this works, it bypasses Serverless Framework's automation, which I'd prefer to retain.

Question:

How can I properly deploy a signed Lambda package with an S3 event trigger using the Serverless Framework?
Are there recommended approaches to avoid the Custom Resource Lambda being incompatible with signed packages?

Any guidance would be greatly appreciated!

Thank you!