An HPC workflow builds container images with CodeBuild and pushes them to ECR, then deploys them to EKS. To meet compliance, images must be signed before EKS deployment; signing keys must be rotated automatically and signing events must be attributable to users. Which approach requires the least operational effort?

The correct approach integrates signing into the existing CodeBuild process using AWS Signer, minimizing operational overhead. CodeBuild is already building the images, so signing them immediately before pushing to ECR is a natural fit. AWS Signer handles key rotation automatically and provides a secure, managed service for signing. CloudTrail automatically logs API calls, including those made to AWS Signer, ensuring signing events are attributable to users without extra configuration. Incorrect options: Pulling an image already pushed to ECR (first option) adds an unnecessary pull and push cycle, increasing complexity and latency. Using a Lambda function to pull and sign (second and third options) introduces an additional component (Lambda) to manage and orchestrate, increasing operational effort compared to integrating directly with CodeBuild. CloudWatch (second and third options) is primarily for monitoring metrics and logs, not for tracking user-attributable API actions like CloudTrail.