ecr-scan-verifier 0.0.7 → 0.1.0

package/.jsii

@@ -3961,7 +3961,7 @@
   },
   "name": "ecr-scan-verifier",
   "readme": {
-    "markdown": "# ecr-scan-verifier\n\nAn AWS CDK Construct that **blocks deployments** to ECS, Lambda, and other services when **ECR Image Scanning detects vulnerabilities**.\n\nIt scans a specified container image during CDK deployment using Basic or Enhanced (Amazon Inspector) scanning.\n\n- **Block any construct's deployment** — block ECS, Lambda, or any CDK construct on vulnerability detection via `blockConstructs`\n- **Notify without failing** — get alerts via SNS without blocking deployment. Great for gradual adoption\n- **Scan logs output** — results go to S3 or CloudWatch Logs\n- **SBOM generation** — output Software Bill of Materials in CycloneDX or SPDX format to S3 via Amazon Inspector\n\n## Scanning Modes\n\nThis construct supports two scanning modes. With Basic scanning, the construct starts a scan via API during deployment, or checks existing scan-on-push results. Enhanced scanning (Amazon Inspector) only supports scan-on-push, but additionally enables SBOM generation.\n\n| Feature | Basic Scanning | Enhanced Scanning |\n|---|---|---|\n| Start scan via API | ✅ (`startScan: true`) | — |\n| Check scan-on-push results | ✅ (`startScan: false`) | ✅ |\n| SBOM generation | — | ✅ |\n\n### Prerequisites\n\nWhen using `ScanConfig.basic({ startScan: true })` (the default), the construct starts a scan via the ECR `StartImageScan` API during deployment — no additional ECR configuration is required.\n\nFor all other modes, **scan-on-push must be enabled** on your ECR repository or account before deployment:\n\n- **`ScanConfig.basic({ startScan: false })`** — requires Basic scan-on-push to be enabled on the repository\n- **`ScanConfig.enhanced()`** — requires Enhanced scanning (Amazon Inspector) to be enabled on the account, with the repository included in Inspector's coverage\n\nIf scan-on-push is not configured and no prior scan results exist, the deployment will fail with an error.\n\n> **Tip**: `startScan: true` works even when scan-on-push is already enabled. If a scan has already been triggered, the construct simply uses the existing scan results.\n\n## Usage\n\n### Install\n\n```sh\nnpm install ecr-scan-verifier\n```\n\n### CDK Code\n\nThe following code is a minimal example that scans the image and blocks the ECS deployment if vulnerabilities are detected.\n\n```ts\nimport { EcrScanVerifier, ScanConfig } from 'ecr-scan-verifier';\n\n// Target image to scan\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\n// Example of an ECS construct that uses the image\nconst ecs = new YourECSConstruct(this, 'YourECSConstruct', {\n  dockerImage: image,\n});\n\n// Scan the image before deploying to ECS\nnew EcrScanVerifier(this, 'ImageScanner', {\n  repository: image.repository,\n  imageTag: image.assetHash,\n  scanConfig: ScanConfig.basic(),\n  // If vulnerabilities are detected, the ECS deployment will be blocked\n  blockConstructs: [ecs],\n});\n```\n\n### Image Tag\n\nYou can specify which image to scan by tag or digest:\n\n```ts\n// Scan by tag (default: 'latest')\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  imageTag: 'v1.0',\n});\n\n// Scan by digest (if the value starts with 'sha256:', it is treated as a digest)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  imageTag: 'sha256:abc123...',\n});\n```\n\n### Scan Configuration\n\nUse `ScanConfig` to choose between Basic and Enhanced scanning:\n\n```ts\nimport { ScanConfig } from 'ecr-scan-verifier';\n\n// Basic scanning (default) — starts a scan via StartImageScan API\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic({ startScan: true }),\n});\n\n// Basic scanning — polls for existing scan results (useful when scan-on-push is configured)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic({ startScan: false }),\n});\n\n// Enhanced scanning — uses Amazon Inspector (scan-on-push only)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.enhanced(),\n});\n```\n\nSee [Prerequisites](#prerequisites) for the scan-on-push requirements of each mode.\n\n> **Important**: If Enhanced scanning (Amazon Inspector) is enabled on your account, you must use `ScanConfig.enhanced()`. Using `ScanConfig.basic()` with an Enhanced scanning account will result in a deployment error.\n\n### Severity\n\nYou can specify which severity levels trigger a failure:\n\n```ts\nimport { Severity } from 'ecr-scan-verifier';\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  severity: [Severity.CRITICAL, Severity.HIGH],\n});\n```\n\nAvailable severity levels: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, `UNDEFINED`.\n\n### Ignore Findings\n\nYou can ignore specific CVEs:\n\n```ts\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  ignoreFindings: ['CVE-2023-37920', 'CVE-2024-12345'],\n});\n```\n\n### Scan Logs Output\n\nYou can choose where to output the scan logs using `ScanLogsOutput`: S3 or CloudWatch Logs. If not specified, scan logs are written to the Scanner Lambda function's default log group.\n\n#### S3\n\n```ts\nimport { ScanLogsOutput } from 'ecr-scan-verifier';\n\nconst scanLogsBucket = new Bucket(this, 'ScanLogsBucket');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  scanLogsOutput: ScanLogsOutput.s3({\n    bucket: scanLogsBucket,\n    prefix: 'scan-logs/', // Optional\n  }),\n});\n```\n\n#### CloudWatch Logs\n\n```ts\nimport { ScanLogsOutput } from 'ecr-scan-verifier';\n\nconst scanLogsLogGroup = new LogGroup(this, 'ScanLogsLogGroup');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  scanLogsOutput: ScanLogsOutput.cloudWatchLogs({ logGroup: scanLogsLogGroup }),\n});\n```\n\n#### Default Log Group\n\nYou can customize the Scanner Lambda function's log group with `defaultLogGroup`.\n\nIf you use `EcrScanVerifier` construct multiple times in the same stack, you have to set the same log group for `defaultLogGroup` for each construct. When you set different log groups for each construct, a warning message will be displayed.\n\n```ts\nconst logGroup = new LogGroup(this, 'LogGroup');\n\nnew EcrScanVerifier(this, 'Scanner1', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  defaultLogGroup: logGroup,\n});\n\nnew EcrScanVerifier(this, 'Scanner2', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  defaultLogGroup: new LogGroup(this, 'AnotherLogGroup'), // NG: different log group from Scanner1\n  defaultLogGroup: logGroup, // OK: Use the same log group as Scanner1 to avoid warning\n});\n```\n\n### SBOM Output\n\nYou can generate SBOM (Software Bill of Materials) using Amazon Inspector's CreateSbomExport API. This is independent from scan logs output.\n\n**Note**: SBOM export is only available with Enhanced scanning. Using with Basic scanning will throw an error.\n\n```ts\nimport { SbomOutput, ScanConfig } from 'ecr-scan-verifier';\n\nconst sbomBucket = new Bucket(this, 'SbomBucket');\nconst sbomEncryptionKey = new Key(this, 'SbomEncryptionKey');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.enhanced(),\n  sbomOutput: SbomOutput.cycloneDx14({\n    bucket: sbomBucket,\n    prefix: 'sbom/', // Optional\n    encryptionKey: sbomEncryptionKey,\n  }),\n});\n```\n\nAvailable SBOM formats:\n\n- `SbomOutput.cycloneDx14()` — CycloneDX 1.4 JSON format\n- `SbomOutput.spdx23()` — SPDX 2.3 JSON format\n\n### SNS Notification for Vulnerabilities\n\nYou can configure an SNS topic via `vulnsNotificationTopic` to receive notifications when vulnerabilities are detected.\n\nBy default, the construct fails the deployment when vulnerabilities are found.\nYou can set `failOnVulnerability: false` to receive SNS notifications without blocking the deployment.\n\n```ts\nconst notificationTopic = new Topic(this, 'VulnerabilityNotificationTopic');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  vulnsNotificationTopic: notificationTopic,\n  failOnVulnerability: false, // Notify but don't fail deployment\n});\n```\n"
+    "markdown": "# ecr-scan-verifier\n\nAn AWS CDK Construct that **blocks deployments to ECS, Lambda, and other services when ECR Image Scanning detects vulnerabilities**, and optionally **verifies container image signatures**.\n\nIt scans specified container images during CDK deployment using Basic or Enhanced (Amazon Inspector) scanning, and can verify image signatures with Notation (AWS Signer) or Cosign (Sigstore).\n\n- **Block any construct's deployment** — block ECS, Lambda, or any CDK construct on vulnerability detection via `blockConstructs`\n- **Signature verification** — verify image signatures with Notation (AWS Signer) or Cosign (Sigstore) before scanning\n- **Notify without failing** — get alerts via SNS without blocking deployment. Great for gradual adoption\n- **Scan logs output** — results go to S3 or CloudWatch Logs\n- **SBOM generation** — output Software Bill of Materials in CycloneDX or SPDX format to S3 via Amazon Inspector\n\n## Scanning Modes\n\nThis construct supports three scanning modes.\n\nWith **Basic scanning**, the construct starts a scan via API during deployment, or checks existing scan-on-push results.\n\n**Enhanced scanning** (Amazon Inspector) only supports scan-on-push, but additionally enables SBOM generation.\n\n**Signature Only mode** skips vulnerability scanning entirely and only verifies image signatures.\n\n| Feature | Basic Scanning | Enhanced Scanning | Signature Only |\n| --- | --- | --- | --- |\n| Start scan via API | ✅ (`startScan: true`) | — | — |\n| Check scan-on-push results | ✅ (`startScan: false`) | ✅ | — |\n| SBOM generation | — | ✅ | — |\n| Signature verification | ✅ (optional) | ✅ (optional) | ✅ (required) |\n\n### Prerequisites\n\nWhen using `ScanConfig.basic({ startScan: true })` (the default), the construct starts a scan via the ECR `StartImageScan` API during deployment — no additional ECR configuration is required.\n\nFor the following modes, **scan-on-push must be enabled** on your ECR repository or account before deployment:\n\n- **`ScanConfig.basic({ startScan: false })`** — requires Basic scan-on-push to be enabled on the repository\n- **`ScanConfig.enhanced()`** — requires Enhanced scanning (Amazon Inspector) to be enabled on the account, with the repository included in Inspector's coverage\n\n`ScanConfig.signatureOnly()` does not require scan-on-push, as it only verifies image signatures without scanning.\n\nIf scan-on-push is not configured and no prior scan results exist, the deployment will fail with an error.\n\n> **Tip**: `startScan: true` works even when scan-on-push is already enabled. If a scan has already been triggered, the construct simply uses the existing scan results.\n\n## Usage\n\n### Install\n\n```sh\nnpm install ecr-scan-verifier\n```\n\n### CDK Code\n\nThe following code is a minimal example that scans the image and blocks the ECS deployment if vulnerabilities are detected.\n\n```ts\nimport { EcrScanVerifier, ScanConfig } from 'ecr-scan-verifier';\n\n// Target image to scan\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\n// Example of an ECS construct that uses the image\nconst ecs = new YourECSConstruct(this, 'YourECSConstruct', {\n  dockerImage: image,\n});\n\n// Scan the image before deploying to ECS\nnew EcrScanVerifier(this, 'ImageScanner', {\n  repository: image.repository,\n  imageTag: image.assetHash,\n  scanConfig: ScanConfig.basic(),\n  // If vulnerabilities are detected, the ECS deployment will be blocked\n  blockConstructs: [ecs],\n});\n```\n\n### Image Tag\n\nYou can specify which image to scan by tag or digest:\n\n```ts\n// Scan by tag (default: 'latest')\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  imageTag: 'v1.0',\n});\n\n// Scan by digest (if the value starts with 'sha256:', it is treated as a digest)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  imageTag: 'sha256:abc123...',\n});\n```\n\n### Scan Configuration\n\nUse `ScanConfig` to choose between Basic and Enhanced scanning:\n\n```ts\nimport { ScanConfig } from 'ecr-scan-verifier';\n\n// Basic scanning (default) — starts a scan via StartImageScan API\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic({ startScan: true }),\n});\n\n// Basic scanning — polls for existing scan results (useful when scan-on-push is configured)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic({ startScan: false }),\n});\n\n// Enhanced scanning — uses Amazon Inspector (scan-on-push only)\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.enhanced(),\n});\n```\n\nSee [Prerequisites](#prerequisites) for the scan-on-push requirements of each mode.\n\n> **Important**: If Enhanced scanning (Amazon Inspector) is enabled on your account, you must use `ScanConfig.enhanced()`. Using `ScanConfig.basic()` with an Enhanced scanning account will result in a deployment error.\n\n### Severity\n\nYou can specify which severity levels trigger a failure:\n\n```ts\nimport { Severity } from 'ecr-scan-verifier';\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  severity: [Severity.CRITICAL, Severity.HIGH],\n});\n```\n\nAvailable severity levels: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, `UNDEFINED`.\n\n### Ignore Findings\n\nYou can ignore specific CVEs:\n\n```ts\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  ignoreFindings: ['CVE-2023-37920', 'CVE-2024-12345'],\n});\n```\n\n### Scan Logs Output\n\nYou can choose where to output the scan logs using `ScanLogsOutput`: S3 or CloudWatch Logs. If not specified, scan logs are written to the Scanner Lambda function's default log group.\n\n#### S3\n\n```ts\nimport { ScanLogsOutput } from 'ecr-scan-verifier';\n\nconst scanLogsBucket = new Bucket(this, 'ScanLogsBucket');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  scanLogsOutput: ScanLogsOutput.s3({\n    bucket: scanLogsBucket,\n    prefix: 'scan-logs/', // Optional\n  }),\n});\n```\n\n#### CloudWatch Logs\n\n```ts\nimport { ScanLogsOutput } from 'ecr-scan-verifier';\n\nconst scanLogsLogGroup = new LogGroup(this, 'ScanLogsLogGroup');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  scanLogsOutput: ScanLogsOutput.cloudWatchLogs({ logGroup: scanLogsLogGroup }),\n});\n```\n\n#### Default Log Group\n\nYou can customize the Scanner Lambda function's log group with `defaultLogGroup`.\n\nIf you use `EcrScanVerifier` construct multiple times in the same stack, you have to set the same log group for `defaultLogGroup` for each construct. When you set different log groups for each construct, a warning message will be displayed.\n\n```ts\nconst logGroup = new LogGroup(this, 'LogGroup');\n\nnew EcrScanVerifier(this, 'Scanner1', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  defaultLogGroup: logGroup,\n});\n\nnew EcrScanVerifier(this, 'Scanner2', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  defaultLogGroup: new LogGroup(this, 'AnotherLogGroup'), // NG: different log group from Scanner1\n  defaultLogGroup: logGroup, // OK: Use the same log group as Scanner1 to avoid warning\n});\n```\n\n### SBOM Output\n\nYou can generate SBOM (Software Bill of Materials) using Amazon Inspector's CreateSbomExport API.\n\n**Note**: SBOM export is only available with Enhanced scanning.\n\n```ts\nimport { SbomOutput, ScanConfig } from 'ecr-scan-verifier';\n\nconst sbomBucket = new Bucket(this, 'SbomBucket');\nconst sbomEncryptionKey = new Key(this, 'SbomEncryptionKey');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.enhanced(),\n  sbomOutput: SbomOutput.cycloneDx14({\n    bucket: sbomBucket,\n    prefix: 'sbom/', // Optional\n    encryptionKey: sbomEncryptionKey,\n  }),\n});\n```\n\nAvailable SBOM formats:\n\n- `SbomOutput.cycloneDx14()` — CycloneDX 1.4 JSON format\n- `SbomOutput.spdx23()` — SPDX 2.3 JSON format\n\n### Signature Verification\n\nYou can verify container image signatures before scanning using Notation (AWS Signer) or Cosign (Sigstore).\n\nSignature verification is performed before the vulnerability scan during deployment. If verification fails and `failOnUnsigned` is `true` (the default), the deployment will fail.\n\n#### Notation (AWS Signer)\n\n```ts\nimport { SignatureVerification, ScanConfig } from 'ecr-scan-verifier';\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  signatureVerification: SignatureVerification.notation({\n    trustedIdentities: ['arn:aws:signer:us-east-1:123456789012:/signing-profiles/MyProfile'],\n  }),\n});\n```\n\n#### Cosign with Public Key\n\n```ts\nimport { readFileSync } from 'fs';\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  signatureVerification: SignatureVerification.cosignPublicKey({\n    publicKey: readFileSync('path/to/cosign.pub', 'utf-8'),\n  }),\n});\n```\n\n#### Cosign with KMS\n\n```ts\nimport { Key } from 'aws-cdk-lib/aws-kms';\n\nconst cosignKey = Key.fromKeyArn(this, 'CosignKey', 'arn:aws:kms:...');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  signatureVerification: SignatureVerification.cosignKms({\n    key: cosignKey,\n  }),\n});\n```\n\n### SNS Notification for Vulnerabilities\n\nYou can configure an SNS topic via `vulnsNotificationTopic` to receive notifications when vulnerabilities are detected.\n\nBy default, the construct fails the deployment when vulnerabilities are found.\nYou can set `failOnVulnerability: false` to receive SNS notifications without blocking the deployment.\n\n```ts\nconst notificationTopic = new Topic(this, 'VulnerabilityNotificationTopic');\n\nnew EcrScanVerifier(this, 'Scanner', {\n  repository,\n  scanConfig: ScanConfig.basic(),\n  vulnsNotificationTopic: notificationTopic,\n  failOnVulnerability: false, // Notify but don't fail deployment\n});\n```\n"
   },
   "repository": {
     "type": "git",
@@ -3985,7 +3985,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/scan-config.ts",
-        "line": 4
+        "line": 6
       },
       "name": "BasicScanConfigOptions",
       "properties": [
@@ -4000,7 +4000,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 27
+            "line": 29
           },
           "name": "startScan",
           "optional": true,
@@ -4082,6 +4082,85 @@
       ],
       "symbolId": "src/scan-logs-output:CloudWatchLogsOutputProps"
     },
+    "ecr-scan-verifier.CosignKmsVerificationOptions": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "remarks": "**Note on Rekor Transparency Log:**\nThis implementation skips Rekor transparency log verification and verifies only\nthe cryptographic signature using the KMS key.\nThe Lambda function always uses the `--insecure-ignore-tlog` flag when running cosign verify.",
+        "see": "https://docs.sigstore.dev/cosign/key_management/overview/",
+        "stability": "stable",
+        "summary": "Options for Cosign signature verification using an AWS KMS key."
+      },
+      "fqn": "ecr-scan-verifier.CosignKmsVerificationOptions",
+      "interfaces": [
+        "ecr-scan-verifier.VerificationOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 59
+      },
+      "name": "CosignKmsVerificationOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "AWS KMS key used to verify the image signature."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 63
+          },
+          "name": "key",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_kms.IKey"
+          }
+        }
+      ],
+      "symbolId": "src/signature-verification:CosignKmsVerificationOptions"
+    },
+    "ecr-scan-verifier.CosignPublicKeyVerificationOptions": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "remarks": "**Note on Rekor Transparency Log:**\nThis implementation skips Rekor transparency log verification and verifies only\nthe cryptographic signature using the public key.\nThe Lambda function always uses the `--insecure-ignore-tlog` flag when running cosign verify.",
+        "see": "https://docs.sigstore.dev/cosign/key_management/overview/",
+        "stability": "stable",
+        "summary": "Options for Cosign signature verification using a public key."
+      },
+      "fqn": "ecr-scan-verifier.CosignPublicKeyVerificationOptions",
+      "interfaces": [
+        "ecr-scan-verifier.VerificationOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 40
+      },
+      "name": "CosignPublicKeyVerificationOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "example": "'-----BEGIN PUBLIC KEY-----\\nMIIBI...\\n-----END PUBLIC KEY-----'",
+            "stability": "stable",
+            "summary": "The PEM-encoded public key content used to verify the image signature."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 46
+          },
+          "name": "publicKey",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/signature-verification:CosignPublicKeyVerificationOptions"
+    },
     "ecr-scan-verifier.EcrScanVerifier": {
       "assembly": "ecr-scan-verifier",
       "base": "constructs.Construct",
@@ -4097,7 +4176,7 @@
         },
         "locationInModule": {
           "filename": "src/ecr-scan-verifier.ts",
-          "line": 140
+          "line": 143
         },
         "parameters": [
           {
@@ -4123,7 +4202,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/ecr-scan-verifier.ts",
-        "line": 137
+        "line": 140
       },
       "name": "EcrScanVerifier",
       "symbolId": "src/ecr-scan-verifier:EcrScanVerifier"
@@ -4139,7 +4218,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/ecr-scan-verifier.ts",
-        "line": 19
+        "line": 26
       },
       "name": "EcrScanVerifierProps",
       "properties": [
@@ -4152,7 +4231,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 23
+            "line": 30
           },
           "name": "repository",
           "type": {
@@ -4169,7 +4248,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 48
+            "line": 55
           },
           "name": "scanConfig",
           "type": {
@@ -4186,7 +4265,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 129
+            "line": 132
           },
           "name": "blockConstructs",
           "optional": true,
@@ -4210,7 +4289,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 106
+            "line": 109
           },
           "name": "defaultLogGroup",
           "optional": true,
@@ -4228,7 +4307,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 66
+            "line": 73
           },
           "name": "failOnVulnerability",
           "optional": true,
@@ -4247,7 +4326,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 76
+            "line": 83
           },
           "name": "ignoreFindings",
           "optional": true,
@@ -4271,7 +4350,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 33
+            "line": 40
           },
           "name": "imageTag",
           "optional": true,
@@ -4279,25 +4358,6 @@
             "primitive": "string"
           }
         },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "- no SBOM output",
-            "remarks": "SBOM export uses Amazon Inspector's CreateSbomExport API to generate SBOM\nand uploads it to S3.\n\n**Note**: SBOM export is only available with Enhanced scanning (Amazon Inspector).\nUsing with Basic scanning will throw an error.",
-            "stability": "stable",
-            "summary": "SBOM (Software Bill of Materials) output configuration."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/ecr-scan-verifier.ts",
-            "line": 96
-          },
-          "name": "sbomOutput",
-          "optional": true,
-          "type": {
-            "fqn": "ecr-scan-verifier.SbomOutput"
-          }
-        },
         {
           "abstract": true,
           "docs": {
@@ -4308,7 +4368,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 83
+            "line": 90
           },
           "name": "scanLogsOutput",
           "optional": true,
@@ -4327,7 +4387,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 58
+            "line": 65
           },
           "name": "severity",
           "optional": true,
@@ -4340,6 +4400,25 @@
             }
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no signature verification",
+            "remarks": "Verifies the image signature before scanning using Notation (AWS Signer) or Cosign (Sigstore).",
+            "stability": "stable",
+            "summary": "Signature verification configuration for the container image."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecr-scan-verifier.ts",
+            "line": 99
+          },
+          "name": "signatureVerification",
+          "optional": true,
+          "type": {
+            "fqn": "ecr-scan-verifier.SignatureVerification"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4350,7 +4429,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 113
+            "line": 116
           },
           "name": "suppressErrorOnRollback",
           "optional": true,
@@ -4369,7 +4448,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/ecr-scan-verifier.ts",
-            "line": 122
+            "line": 125
           },
           "name": "vulnsNotificationTopic",
           "optional": true,
@@ -4391,11 +4470,76 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/scan-config.ts",
-        "line": 33
+        "line": 35
       },
       "name": "EnhancedScanConfigOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no SBOM output",
+            "remarks": "SBOM export uses Amazon Inspector's CreateSbomExport API to generate SBOM\nand uploads it to S3.",
+            "stability": "stable",
+            "summary": "SBOM (Software Bill of Materials) output configuration."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/scan-config.ts",
+            "line": 44
+          },
+          "name": "sbomOutput",
+          "optional": true,
+          "type": {
+            "fqn": "ecr-scan-verifier.SbomOutput"
+          }
+        }
+      ],
       "symbolId": "src/scan-config:EnhancedScanConfigOptions"
     },
+    "ecr-scan-verifier.NotationVerificationOptions": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Options for Notation (AWS Signer) signature verification."
+      },
+      "fqn": "ecr-scan-verifier.NotationVerificationOptions",
+      "interfaces": [
+        "ecr-scan-verifier.VerificationOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 19
+      },
+      "name": "NotationVerificationOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "example": "['arn:aws:signer:us-east-1:123456789012:/signing-profiles/MyProfile']",
+            "remarks": "At least one signing profile ARN must be specified.",
+            "stability": "stable",
+            "summary": "Trusted signing profile ARNs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 27
+          },
+          "name": "trustedIdentities",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/signature-verification:NotationVerificationOptions"
+    },
     "ecr-scan-verifier.S3OutputOptions": {
       "assembly": "ecr-scan-verifier",
       "datatype": true,
@@ -4789,7 +4933,7 @@
       "abstract": true,
       "assembly": "ecr-scan-verifier",
       "docs": {
-        "remarks": "Use `ScanConfig.basic()` for ECR native basic scanning,\nor `ScanConfig.enhanced()` for Amazon Inspector enhanced scanning.",
+        "remarks": "Use `ScanConfig.basic()` for ECR native basic scanning,\n`ScanConfig.enhanced()` for Amazon Inspector enhanced scanning,\nor `ScanConfig.signatureOnly()` for signature verification without scanning.",
         "stability": "stable",
         "summary": "Configuration for ECR image scan type."
       },
@@ -4802,7 +4946,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/scan-config.ts",
-        "line": 58
+        "line": 81
       },
       "methods": [
         {
@@ -4813,7 +4957,7 @@
           },
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 64
+            "line": 87
           },
           "name": "basic",
           "parameters": [
@@ -4840,7 +4984,7 @@
           },
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 75
+            "line": 98
           },
           "name": "enhanced",
           "parameters": [
@@ -4859,6 +5003,33 @@
           },
           "static": true
         },
+        {
+          "docs": {
+            "remarks": "Verifies the image signature without performing vulnerability scanning.\nThis mode skips ECR/Inspector scanning entirely and only validates the image signature.\n\n**Requirements**:\n- `signatureVerification` must be specified in EcrScanVerifierProps",
+            "stability": "stable",
+            "summary": "Signature verification only (no vulnerability scanning)."
+          },
+          "locationInModule": {
+            "filename": "src/scan-config.ts",
+            "line": 111
+          },
+          "name": "signatureOnly",
+          "parameters": [
+            {
+              "name": "options",
+              "optional": true,
+              "type": {
+                "fqn": "ecr-scan-verifier.SignatureOnlyConfigOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "ecr-scan-verifier.ScanConfig"
+            }
+          },
+          "static": true
+        },
         {
           "abstract": true,
           "docs": {
@@ -4867,7 +5038,7 @@
           },
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 82
+            "line": 118
           },
           "name": "bind",
           "returns": {
@@ -4891,7 +5062,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/scan-config.ts",
-        "line": 40
+        "line": 57
       },
       "name": "ScanConfigBindOutput",
       "properties": [
@@ -4899,12 +5070,12 @@
           "abstract": true,
           "docs": {
             "stability": "stable",
-            "summary": "The scan type ('BASIC' or 'ENHANCED')."
+            "summary": "The scan type ('BASIC', 'ENHANCED', or 'SIGNATURE_ONLY')."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 44
+            "line": 61
           },
           "name": "scanType",
           "type": {
@@ -4920,12 +5091,29 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/scan-config.ts",
-            "line": 49
+            "line": 66
           },
           "name": "startScan",
           "type": {
             "primitive": "boolean"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "SBOM output configuration (Enhanced scanning only)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/scan-config.ts",
+            "line": 71
+          },
+          "name": "sbomOutput",
+          "optional": true,
+          "type": {
+            "fqn": "ecr-scan-verifier.SbomOutput"
+          }
         }
       ],
       "symbolId": "src/scan-config:ScanConfigBindOutput"
@@ -5147,8 +5335,293 @@
       ],
       "name": "Severity",
       "symbolId": "src/types:Severity"
+    },
+    "ecr-scan-verifier.SignatureOnlyConfigOptions": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Options for signature-only verification (no scanning)."
+      },
+      "fqn": "ecr-scan-verifier.SignatureOnlyConfigOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/scan-config.ts",
+        "line": 50
+      },
+      "name": "SignatureOnlyConfigOptions",
+      "symbolId": "src/scan-config:SignatureOnlyConfigOptions"
+    },
+    "ecr-scan-verifier.SignatureVerification": {
+      "abstract": true,
+      "assembly": "ecr-scan-verifier",
+      "docs": {
+        "remarks": "Supports Notation (AWS Signer) and Cosign (Sigstore) verification methods.\nSignature verification is performed before the vulnerability scan during deployment.",
+        "stability": "stable",
+        "summary": "Signature verification configuration for container images."
+      },
+      "fqn": "ecr-scan-verifier.SignatureVerification",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 102
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "**Important:** Cosign verification skips Rekor transparency log verification.\n\nSign your images with:\n```bash\ncosign sign --tlog-upload=false --key awskms:///KMS_KEY_ARN IMAGE\n```",
+            "stability": "stable",
+            "summary": "Verify image signature using Cosign with an AWS KMS key."
+          },
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 138
+          },
+          "name": "cosignKms",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "ecr-scan-verifier.CosignKmsVerificationOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "ecr-scan-verifier.SignatureVerification"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "**Important:** Cosign verification skips Rekor transparency log verification.\n\nSign your images with:\n```bash\ncosign sign --tlog-upload=false --key cosign.pub IMAGE\n```",
+            "stability": "stable",
+            "summary": "Verify image signature using Cosign with a public key."
+          },
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 122
+          },
+          "name": "cosignPublicKey",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "ecr-scan-verifier.CosignPublicKeyVerificationOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "ecr-scan-verifier.SignatureVerification"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "Requires the image to be signed with AWS Signer.",
+            "stability": "stable",
+            "summary": "Verify image signature using Notation (AWS Signer)."
+          },
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 108
+          },
+          "name": "notation",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "ecr-scan-verifier.NotationVerificationOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "ecr-scan-verifier.SignatureVerification"
+            }
+          },
+          "static": true
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Returns the signature verification configuration."
+          },
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 145
+          },
+          "name": "bind",
+          "parameters": [
+            {
+              "name": "grantee",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "ecr-scan-verifier.SignatureVerificationBindOutput"
+            }
+          }
+        }
+      ],
+      "name": "SignatureVerification",
+      "symbolId": "src/signature-verification:SignatureVerification"
+    },
+    "ecr-scan-verifier.SignatureVerificationBindOutput": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Output of SignatureVerification.bind()."
+      },
+      "fqn": "ecr-scan-verifier.SignatureVerificationBindOutput",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 69
+      },
+      "name": "SignatureVerificationBindOutput",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Whether to fail the deployment on unsigned images."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 93
+          },
+          "name": "failOnUnsigned",
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The verification type."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 73
+          },
+          "name": "type",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "KMS key ARN (Cosign KMS only)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 88
+          },
+          "name": "kmsKeyArn",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Public key content (Cosign public key only)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 83
+          },
+          "name": "publicKey",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Trusted signing profile ARNs (Notation only)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 78
+          },
+          "name": "trustedIdentities",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/signature-verification:SignatureVerificationBindOutput"
+    },
+    "ecr-scan-verifier.VerificationOptions": {
+      "assembly": "ecr-scan-verifier",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Common options for signature verification."
+      },
+      "fqn": "ecr-scan-verifier.VerificationOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/signature-verification.ts",
+        "line": 7
+      },
+      "name": "VerificationOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "stable",
+            "summary": "Whether to fail the deployment if the image is unsigned or signature verification fails."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/signature-verification.ts",
+            "line": 13
+          },
+          "name": "failOnUnsigned",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        }
+      ],
+      "symbolId": "src/signature-verification:VerificationOptions"
     }
   },
-  "version": "0.0.7",
-  "fingerprint": "rpRXa3wmEwqE3/fhkLgqDT2AgdB5XQvatoxtHWmJtaw="
+  "version": "0.1.0",
+  "fingerprint": "eE+K+wUfGqQqUmqRaujP3LCH4sXfZKAEUOqL6KzhSQw="
 }