How to secure appspec file?
The way I handled this in the past was to have a separate repository that contains the scripts, as most of them ended up shared across multiple projects anyway.  Then your appspec.yml file just contains references to the scripts and imports them via a submodule.  It's not perfect because a developer could change the appspec.yml to call his own scripts instead, although that's a lot more obvious.

Another approach I have used on Azure is to require that scripts are signed with a specific GPG key.  I used a PowerShell and a CodeSigning certificate, but I suspect there is an equally suitable solution with GPG.

A final approach would be to automatically fail the build or reject the commit if changes are detected within appspec.yml except when those changes are made by an "approved" person.