Amazon Web Services published a guide on October 12, 2026, detailing how builders can construct a post-quantum software supply chain using Module-Lattice-Based Digital Signature Algorithm capabilities.
What it does
Amazon Web Services states that its architecture comprises five trust pillars combining ML-DSA key management in AWS KMS, public key infrastructure via AWS Private CA, workload identity with IAM Roles Anywhere, artifact signing, and software bill of materials integrity attestation.
These pillars establish an end-to-end signing architecture for binaries, container images, and software bills of materials to defend against future quantum computing threats.
Before you start
Amazon Web Services says you need an AWS account with permissions to create resources in AWS KMS, AWS Private CA, IAM Roles Anywhere, and Amazon ECR.
You also need the AWS CLI v2, the IAM Roles Anywhere credential helper v1.8.0 or later, OpenSSL 3.5 or later, ORAS CLI v1.2 or later, jq, and the Amazon Inspector SBOM Generator.
Steps
Step 1: Amazon Web Services says you can create the root CA in AWS Private CA by running the create-certificate-authority command with KeyAlgorithm set to ML_DSA_87 and activating it by self-signing its certificate.
Step 2: Amazon Web Services says you can create a subordinate CA for code signing by running the create-certificate-authority command with KeyAlgorithm set to ML_DSA_65 and signing its certificate signing request with the root CA.
Step 3: Amazon Web Services says you can create the code-signing key in AWS KMS using the aws kms create-key command with the key spec set to ML_DSA_65 and key usage set to SIGN_VERIFY.
Step 4: Amazon Web Services says you can issue the end-entity code signing certificate by constructing a CSR around a KMS-managed private key and issuing the certificate from your subordinate CA.
What the company says
Amazon Web Services states that using quantum-resistant signatures today defends against threats that might emerge in the future if a sufficiently powerful quantum computer could forge traditional signatures.
The company notes that this approach addresses the forge-later threat across your supply chain using production-ready, generally available services.
What to do
- Create ML-DSA keys in AWS KMS and establish an ML-DSA certificate hierarchy using AWS Private CA.
- Configure IAM Roles Anywhere with ML-DSA certificates to authenticate build agents securely.
Key facts and where they come from
- AWS provides building blocks to construct a quantum-resistant software supply chain using generally available services.
Amazon Web Services (AWS) provides the building blocks to construct a quantum-resistant software supply chain today using production-ready, generally available services.
- The architecture combines ML-DSA keys in AWS KMS, certificate hierarchies in AWS Private CA, and trust anchors in IAM Roles Anywhere.
combine Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys in AWS Key Management Service (AWS KMS), ML-DSA certificate hierarchies in AWS Private Certificate Authority, and ML-DSA trust anchors in AWS Identity and Access Management (IAM) Roles Anywhere
