SAM Doctor

ERROR REFERENCE

Code signing is not supported for container-image functions

The function has a CodeSigningConfigArn and a PackageType: Image at the same time. Lambda code signing verifies zip packages; container images have their own integrity story, so the combination is rejected.

WHAT IT MEANS

What this error means

This usually appears when a function migrates from zip to image packaging and the signing config comes along for the ride — often from a shared Globals section or an organization-standard template that assumes zip functions.

FIX

How to fix it

  1. Remove the signing config from the image function — check the function's own properties and Globals.Function, where a shared CodeSigningConfigArn silently applies to every function in the template.
  2. Keep signing for the zip functions by moving the config from Globals onto the functions that still use zip packaging.
  3. If artifact integrity drove the signing requirement, sign the container image instead - ECR image signing with AWS Signer covers the image path; the compliance goal survives the packaging change.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the incompatibility wording (high confidence). Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED