Sign container images with a cloud KMS-backed key (not keyless Fulcio signing) using cosign and verify against that key in a deploy pipeline

domain: docs.sigstore.dev · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Create a dedicated asymmetric signing key in a cloud KMS or Vault Transit for image signing, separate from general-purpose encryption keys.
  2. Sign the image by digest with cosign sign --key <provider>://<key-reference> <image@sha256:...>, using the provider's URI scheme (awskms://, gcpkms://, azurekms://, or hashivault://).
  3. Grant the CI/CD identity only sign permission on that key (no export/decrypt) via IAM policy scoped to the specific key resource.
  4. In the deploy pipeline, run cosign verify --key <provider>://<key-reference> <image> before allowing rollout to proceed.
  5. Rotate the KMS key version periodically, re-sign newly built images under the new version, and retain access to prior key versions until old signed images age out of use.

Known gotchas

Related routes

Sign a container image keylessly with Cosign 2.x in a CI/CD pipeline
docs.sigstore.dev · 5 steps · unrated
Sign a container image with Sigstore cosign keyless signing (Fulcio + Rekor) and verify it
security-general · 6 steps · unrated
Sign a container image keylessly with cosign and attach the signature to the registry using the cosign sign command
sigstore.dev · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans