DOCS / STANDARDS / SLSA
SLSA
Supply-chain Levels for Software Artifacts — a framework for describing and improving supply chain security, focused on one question: can you trust the process that produced this artifact?
Build Levels
L1
Provenance exists
The build process generates provenance describing how the artifact was built.
L2
Authenticated provenance
Provenance is generated by a hosted build platform and is cryptographically authenticated.
L3
Hardened builds
The build platform provides strong isolation guarantees between builds.
Where CDK fits
CDK's signed attestations satisfy SLSA's provenance and authentication requirements at Build L2. Reaching L3 additionally depends on the isolation guarantees of the underlying build platform — CDK documents which platform produced an artifact, but doesn't itself harden that platform's isolation.