Day 67: Supply Chain: Model and Image Provenance

Your coding agent image is part of the supply chain. If ECS/Lambda pulls :latest from a mutable tag with no attestation, you are running strangers’ code next to your repos. Aim for SLSA-ish provenance: signed images, pinned digests, verified before run.

⚡ TL;DR: Build in CI, sign with Sigstore/Notation, pin digests in task defs, verify admission. Track model IDs/versions the same way.

Pin digests

{
  "image": "123.dkr.ecr.us-east-1.amazonaws.com/agent@sha256:4f2c…"
}

# ✅ verify before deploy
cosign verify \
  --certificate-identity-regexp 'CI' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  123.dkr.ecr.us-east-1.amazonaws.com/agent@sha256:4f2c…

Model provenance

Record provider, model ID, and inference profile ARN in the run audit. Refuse runs when the model ID is not in an allowlist.

ALLOW_MODELS = {
    "anthropic.claude-sonnet-4-20250514-v1:0",
    "amazon.nova-pro-v1:0",
}

def assert_model(mid: str):
    if mid not in ALLOW_MODELS:
        raise RuntimeError(f"model_not_allowed:{mid}")

❌ Floating tags + mystery fine-tunes from a personal HF account in prod agents.

Closing checklist

• [ ] Digest-pinned images
• [ ] Signature verification in deploy
• [ ] Model allowlists
• [ ] SBOM for agent images
• [ ] Audit image digest per run

Series navigation

Day 66: Audit Trails Humans Can Replay · Day 68: Abuse and Cost Attacks

Last updated September 11, 2026