diff --git a/.gitignore b/.gitignore
index 16d1668..84cc5f4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
/kms_signer/obj
*.exe
/lambda_c2pasign/obj
+/.vs
diff --git a/README.md b/README.md
index cff06ab..0853bc2 100644
--- a/README.md
+++ b/README.md
@@ -16,12 +16,13 @@ openssl pkcs8 -topk8 -inform PEM -outform DER -in es256_private.key -out es256_p
## Short Introduction in running c2patool with AWS KMS
-1. using parameter `signer-path`, ref [^3] and [^4]
-
-[^3]: https://github.com/contentauth/c2patool?tab=readme-ov-file#signing-claim-bytes-with-your-own-signer
-
-[^4]: https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/main/lambda_c2pasign/runC2PA.cs#L208)
-
-2. and application that gets claim-bytes per standard-input and returns signed bytestream via standard-output, ref [^5]
-
-[^5]: https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/main/kms_signer/Program.cs#L18
+
+
+1. There's a trigger configured, that once an Object on S3 Bucket has been created in folder "s3BucketPath" (defined by env-variable, default "data"), a call to Lambda function will be initiated. (ref https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/4a185dc5502490e891a8de1c4f493726f3b01be6/lambda_c2pasign/Function.cs#L35)
+2. Lambda Function will download Object to local Store
+3. Starting Signing with given manifest-definition (ref https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/4a185dc5502490e891a8de1c4f493726f3b01be6/lambda_c2pasign/runC2PA.cs#L201).
+To be signed claim-bytes will be sent to AWS KMS - and with stored Config with private Key on AWS KMS (ref https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/main/kms_signer/Program.cs)
+Have a look using parameter `signer-path`, (ref https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/main/lambda_c2pasign/runC2PA.cs#L208) and https://github.com/contentauth/c2patool?tab=readme-ov-file#signing-claim-bytes-with-your-own-signer
+The kms_signer application that gets claim-bytes per standard-input and returns signed bytestream via standard-output (https://github.com/nitrat7/c2pa_sign_awslambdakms/blob/main/kms_signer/Program.cs#L18)
+4. the signed claim bytes will be returned
+5. the signed Object will be transferred back to S3-Bucket in folder "s3BucketPathSigned" (defined by env-variable, default "data_sign")
\ No newline at end of file
diff --git a/doc/c2paSign.drawio b/doc/c2paSign.drawio
new file mode 100644
index 0000000..b1463c7
--- /dev/null
+++ b/doc/c2paSign.drawio
@@ -0,0 +1,85 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/doc/c2paSign.drawio.png b/doc/c2paSign.drawio.png
new file mode 100644
index 0000000..799fdc5
Binary files /dev/null and b/doc/c2paSign.drawio.png differ
diff --git a/doc/fixme_template.yaml b/doc/fixme_template.yaml
new file mode 100644
index 0000000..d27c764
--- /dev/null
+++ b/doc/fixme_template.yaml
@@ -0,0 +1,64 @@
+Transform: AWS::Serverless-2016-10-31
+Resources:
+ FunctionC2PASign:
+ Type: AWS::Serverless::Function
+ Properties:
+ Description: !Sub
+ - Stack ${AWS::StackName} Function ${ResourceName}
+ - ResourceName: FunctionC2PASign
+ CodeUri: lambda_c2pasign/
+ Handler: lambda_c2pasign::c2panalyze2.Function::FunctionHandlerSign
+ Runtime: dotnet8
+ MemorySize: 3008
+ Timeout: 600
+ Tracing: Active
+ Events:
+ BucketC2PASign:
+ Type: S3
+ Properties:
+ Bucket: !Ref BucketC2PASign
+ Events:
+ - s3:ObjectCreated:*
+ FunctionC2PASignLogGroup:
+ Type: AWS::Logs::LogGroup
+ DeletionPolicy: Retain
+ Properties:
+ LogGroupName: !Sub /aws/lambda/${FunctionC2PASign}
+ BucketC2PASign:
+ Type: AWS::S3::Bucket
+ Properties:
+ BucketName: !Sub ${AWS::StackName}-bucketc2p-${AWS::AccountId}
+ BucketEncryption:
+ ServerSideEncryptionConfiguration:
+ - ServerSideEncryptionByDefault:
+ SSEAlgorithm: aws:kms
+ KMSMasterKeyID: alias/aws/s3
+ PublicAccessBlockConfiguration:
+ IgnorePublicAcls: true
+ RestrictPublicBuckets: true
+ BucketC2PASignBucketPolicy:
+ Type: AWS::S3::BucketPolicy
+ Properties:
+ Bucket: !Ref BucketC2PASign
+ PolicyDocument:
+ Id: RequireEncryptionInTransit
+ Version: '2012-10-17'
+ Statement:
+ - Principal: '*'
+ Action: '*'
+ Effect: Deny
+ Resource:
+ - !GetAtt BucketC2PASign.Arn
+ - !Sub ${BucketC2PASign.Arn}/*
+ Condition:
+ Bool:
+ aws:SecureTransport: 'false'
+ RolePolicy:
+ Type: AWS::IAM::RolePolicy
+ Properties:
+ RoleName:
+ PolicyName:
+ Role:
+ Type: AWS::IAM::Role
+ Properties:
+ AssumeRolePolicyDocument:
\ No newline at end of file