What's the best way to ensure that developers can't modify the contents of the appspec.yml file used by AWS CodeDeploy? This file executes scripts on production servers with root privileges so it would be ideal if there were a way to ensure the files can't be modified by anyone with access to the application repository.
Please note that I'm looking for technical suggestions.
Please also note I'm using CodeDeploy as part of CodePipeline with GitHub as source.
The way I handled this in the past was to have a separate repository that contains the scripts, as most of them ended up shared across multiple projects anyway. Then your appspec.yml file just contains references to the scripts and imports them via a submodule. It's not perfect because a developer could change the appspec.yml to call his own scripts instead, although that's a lot more obvious.
Another approach I have used on Azure is to require that scripts are signed with a specific GPG key. I used a PowerShell and a CodeSigning certificate, but I suspect there is an equally suitable solution with GPG.
A final approach would be to automatically fail the build or reject the commit if changes are detected within appspec.yml except when those changes are made by an "approved" person.
You could store this file in a Version Control System (VCS) like CodeCommit and ensure that the developers can only merge it when a pull request has been approved by you.
