<p>The way I handled this in the past was to have a separate repository that contains the scripts, as most of them ended up shared across multiple projects anyway.  Then your <code>appspec.yml</code> file just contains references to the scripts and imports them via a submodule.  It's not perfect because a developer could change the <code>appspec.yml</code> to call his own scripts instead, although that's a lot more obvious.</p>

<p>Another approach I have used on Azure is to require that scripts are signed with a specific GPG key.  I used a PowerShell and a CodeSigning certificate, but I suspect there is an equally suitable solution with GPG.</p>

<p>A final approach would be to automatically fail the build or <a href="https://jakemccrary.com/blog/2015/05/31/use-git-pre-commit-hooks-to-stop-unwanted-commits/" rel="nofollow noreferrer">reject the commit</a> if changes are detected within <code>appspec.yml</code> except when those changes are made by an "approved" person.</p>

CC BY-SA 4.0
2019-10-16T12:44:58.900Z
2019-10-16T12:44:58.900Z
Richard Slater
<p>You could store this file in a Version Control System (VCS) like <a href="https://aws.amazon.com/codecommit/" rel="nofollow noreferrer">CodeCommit</a> and ensure that the developers can only merge it when a pull request has been approved by you.</p>

CC BY-SA 4.0
2019-10-09T18:45:17.643Z
Do you mean merge with the main application repo? The problem is this is part of a CodePipeline that executes on push to the application repository. Are you suggesting having a post commit hook that pulls in the appspec.yml file from a different repo? I'd have to check but this might break the execution of the pipeline
Nelfo
CC BY-SA 4.0
2019-10-09T18:42:00.317Z
2019-10-09T18:42:00.317Z
030
<p>What's the best way to ensure that developers can't modify the contents of the appspec.yml file used by AWS CodeDeploy? This file executes scripts on production servers with root privileges so it would be ideal if there were a way to ensure the files can't be modified by anyone with access to the application repository.</p>

<p>Please note that I'm looking for technical suggestions.</p>

<p>Please also note I'm using CodeDeploy as part of CodePipeline with GitHub as source.</p>

CC BY-SA 4.0
2019-12-23T08:33:25.133Z
Could you indicate whether you solved the issue?
030
<aws-codedeploy>
How to secure appspec file?
Nelfo
# How to secure appspec file?

(Asked by: username_0 on 2019-10-09)

What's the best way to ensure that developers can't modify the contents of the appspec.yml file used by AWS CodeDeploy? This file executes scripts on production servers with root privileges so it would be ideal if there were a way to ensure the files can't be modified by anyone with access to the application repository.

Please note that I'm looking for technical suggestions.

Please also note I'm using CodeDeploy as part of CodePipeline with GitHub as source.

**Tags:** aws-codedeploy

> **Comments:**
> **username_1**: Could you indicate whether you solved the issue?  

---

## 2 answers

### Answer by username_2 on 2019-10-16. Score: 2

The way I handled this in the past was to have a separate repository that contains the scripts, as most of them ended up shared across multiple projects anyway. Then your `appspec.yml` file just contains references to the scripts and imports them via a submodule. It's not perfect because a developer could change the `appspec.yml` to call his own scripts instead, although that's a lot more obvious.

Another approach I have used on Azure is to require that scripts are signed with a specific GPG key. I used a PowerShell and a CodeSigning certificate, but I suspect there is an equally suitable solution with GPG.

A final approach would be to automatically fail the build or [reject the commit](https://jakemccrary.com/blog/2015/05/31/use-git-pre-commit-hooks-to-stop-unwanted-commits/) if changes are detected within `appspec.yml` except when those changes are made by an "approved" person.


---

### Answer by username_1 on 2019-10-09. Score: 1

You could store this file in a Version Control System (VCS) like [CodeCommit](https://aws.amazon.com/codecommit/) and ensure that the developers can only merge it when a pull request has been approved by you.

> **Comments:**
> **username_0**: Do you mean merge with the main application repo? The problem is this is part of a CodePipeline that executes on push to the application repository. Are you suggesting having a post commit hook that pulls in the appspec.yml file from a different repo? I'd have to check but this might break the execution of the pipeline  

---

