Well-architected best practices for software supply chain security

This article provides best practices for defending against software supply chain attacks like Shai-Hulud, aligned with AWS Well-Architected Framework security principles.

• Use temporary credentials and least privilege access to limit credential exposure risk
• Implement defense in depth with multi-factor authentication and approval workflows
• Use AWS Signer for artifact signing with FIPS 140-3 Level 3 HSM protection
• Centralize dependency management via AWS CodeArtifact with upstream source blocking
• Verify npm provenance attestations for open source package integrity
• Scan dependencies continuously throughout development lifecycle with Amazon Inspector
• Detect behavioral anomalies and zero-day malicious packages via cross-account signals
• Configure CloudTrail logging and GuardDuty monitoring for anomalous activity detection
• Use SBOMs to quickly assess exposure and prioritize remediation during incidents

In summary, layered defenses combining temporary credentials, artifact signing, centralized package management, and continuous scanning significantly reduce supply chain attack impact.