2020/08/17 - AWS Certificate Manager Private Certificate Authority - 3 new 2 updated api methods
Changes ACM Private CA is launching cross-account support. This allows customers to share their private CAs with other accounts, AWS Organizations, and organizational units to issue end-entity certificates.
Retrieves the resource-based policy attached to a private CA. If either the private CA resource or the policy cannot be found, this action returns a ResourceNotFoundException .
The policy can be attached or updated with PutPolicy and removed with DeletePolicy.
About Policies
A policy grants access on a private CA to an AWS customer account, to AWS Organizations, or to an AWS Organizations unit. Policies are under the control of a CA administrator. For more information, see Using a Resource Based Policy with ACM Private CA.
A policy permits a user of AWS Certificate Manager (ACM) to issue ACM certificates signed by a CA in another account.
For ACM to manage automatic renewal of these certificates, the ACM user must configure a Service Linked Role (SLR). The SLR allows the ACM service to assume the identity of the user, subject to confirmation against the ACM Private CA policy. For more information, see Using a Service Linked Role with ACM.
Updates made in AWS Resource Manager (RAM) are reflected in policies. For more information, see Using AWS Resource Access Manager (RAM) with ACM Private CA.
See also: AWS API Documentation
Request Syntax
client.get_policy(
ResourceArn='string'
)
string
[REQUIRED]
The Amazon Resource Number (ARN) of the private CA that will have its policy retrieved. You can find the CA's ARN by calling the ListCertificateAuthorities action.
dict
Response Syntax
{
'Policy': 'string'
}
Response Structure
(dict) --
Policy (string) --
The policy attached to the private CA as a JSON document.
Deletes the resource-based policy attached to a private CA. Deletion will remove any access that the policy has granted. If there is no policy attached to the private CA, this action will return successful.
If you delete a policy that was applied through AWS Resource Access Manager (RAM), the CA will be removed from all shares in which it was included.
The AWS Certificate Manager Service Linked Role that the policy supports is not affected when you delete the policy.
The current policy can be shown with GetPolicy and updated with PutPolicy.
About Policies
A policy grants access on a private CA to an AWS customer account, to AWS Organizations, or to an AWS Organizations unit. Policies are under the control of a CA administrator. For more information, see Using a Resource Based Policy with ACM Private CA.
A policy permits a user of AWS Certificate Manager (ACM) to issue ACM certificates signed by a CA in another account.
For ACM to manage automatic renewal of these certificates, the ACM user must configure a Service Linked Role (SLR). The SLR allows the ACM service to assume the identity of the user, subject to confirmation against the ACM Private CA policy. For more information, see Using a Service Linked Role with ACM.
Updates made in AWS Resource Manager (RAM) are reflected in policies. For more information, see Using AWS Resource Access Manager (RAM) with ACM Private CA.
See also: AWS API Documentation
Request Syntax
client.delete_policy(
ResourceArn='string'
)
string
[REQUIRED]
The Amazon Resource Number (ARN) of the private CA that will have its policy deleted. You can find the CA's ARN by calling the ListCertificateAuthorities action. The ARN value must have the form arn:aws:acm-pca:region:account:certificate-authority/01234567-89ab-cdef-0123-0123456789ab .
None
Attaches a resource-based policy to a private CA.
A policy can also be applied by sharing a private CA through AWS Resource Access Manager (RAM).
The policy can be displayed with GetPolicy and removed with DeletePolicy.
About Policies
A policy grants access on a private CA to an AWS customer account, to AWS Organizations, or to an AWS Organizations unit. Policies are under the control of a CA administrator. For more information, see Using a Resource Based Policy with ACM Private CA.
A policy permits a user of AWS Certificate Manager (ACM) to issue ACM certificates signed by a CA in another account.
For ACM to manage automatic renewal of these certificates, the ACM user must configure a Service Linked Role (SLR). The SLR allows the ACM service to assume the identity of the user, subject to confirmation against the ACM Private CA policy. For more information, see Using a Service Linked Role with ACM.
Updates made in AWS Resource Manager (RAM) are reflected in policies. For more information, see Using AWS Resource Access Manager (RAM) with ACM Private CA.
See also: AWS API Documentation
Request Syntax
client.put_policy(
ResourceArn='string',
Policy='string'
)
string
[REQUIRED]
The Amazon Resource Number (ARN) of the private CA to associate with the policy. The ARN of the CA can be found by calling the ListCertificateAuthorities action.
string
[REQUIRED]
The path and filename of a JSON-formatted IAM policy to attach to the specified private CA resource. If this policy does not contain all required statements or if it includes any statement that is not allowed, the PutPolicy action returns an InvalidPolicyException . For information about IAM policy and statement structure, see Overview of JSON Policies.
None
{'CertificateAuthority': {'OwnerAccount': 'string'}}
Lists information about your private certificate authority (CA) or one that has been shared with you. You specify the private CA on input by its ARN (Amazon Resource Name). The output contains the status of your CA. This can be any of the following:
CREATING - ACM Private CA is creating your private certificate authority.
PENDING_CERTIFICATE - The certificate is pending. You must use your ACM Private CA-hosted or on-premises root or subordinate CA to sign your private CA CSR and then import it into PCA.
ACTIVE - Your private CA is active.
DISABLED - Your private CA has been disabled.
EXPIRED - Your private CA certificate has expired.
FAILED - Your private CA has failed. Your CA can fail because of problems such a network outage or backend AWS failure or other errors. A failed CA can never return to the pending state. You must create a new CA.
DELETED - Your private CA is within the restoration period, after which it is permanently deleted. The length of time remaining in the CA's restoration period is also included in this action's output.
See also: AWS API Documentation
Request Syntax
client.describe_certificate_authority(
CertificateAuthorityArn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form:
arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 .
dict
Response Syntax
{
'CertificateAuthority': {
'Arn': 'string',
'OwnerAccount': 'string',
'CreatedAt': datetime(2015, 1, 1),
'LastStateChangeAt': datetime(2015, 1, 1),
'Type': 'ROOT'|'SUBORDINATE',
'Serial': 'string',
'Status': 'CREATING'|'PENDING_CERTIFICATE'|'ACTIVE'|'DELETED'|'DISABLED'|'EXPIRED'|'FAILED',
'NotBefore': datetime(2015, 1, 1),
'NotAfter': datetime(2015, 1, 1),
'FailureReason': 'REQUEST_TIMED_OUT'|'UNSUPPORTED_ALGORITHM'|'OTHER',
'CertificateAuthorityConfiguration': {
'KeyAlgorithm': 'RSA_2048'|'RSA_4096'|'EC_prime256v1'|'EC_secp384r1',
'SigningAlgorithm': 'SHA256WITHECDSA'|'SHA384WITHECDSA'|'SHA512WITHECDSA'|'SHA256WITHRSA'|'SHA384WITHRSA'|'SHA512WITHRSA',
'Subject': {
'Country': 'string',
'Organization': 'string',
'OrganizationalUnit': 'string',
'DistinguishedNameQualifier': 'string',
'State': 'string',
'CommonName': 'string',
'SerialNumber': 'string',
'Locality': 'string',
'Title': 'string',
'Surname': 'string',
'GivenName': 'string',
'Initials': 'string',
'Pseudonym': 'string',
'GenerationQualifier': 'string'
}
},
'RevocationConfiguration': {
'CrlConfiguration': {
'Enabled': True|False,
'ExpirationInDays': 123,
'CustomCname': 'string',
'S3BucketName': 'string'
}
},
'RestorableUntil': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
CertificateAuthority (dict) --
A CertificateAuthority structure that contains information about your private CA.
Arn (string) --
Amazon Resource Name (ARN) for your private certificate authority (CA). The format is 12345678-1234-1234-1234-123456789012 .
OwnerAccount (string) --
The AWS account ID that owns the certificate authority.
CreatedAt (datetime) --
Date and time at which your private CA was created.
LastStateChangeAt (datetime) --
Date and time at which your private CA was last updated.
Type (string) --
Type of your private CA.
Serial (string) --
Serial number of your private CA.
Status (string) --
Status of your private CA.
NotBefore (datetime) --
Date and time before which your private CA certificate is not valid.
NotAfter (datetime) --
Date and time after which your private CA certificate is not valid.
FailureReason (string) --
Reason the request to create your private CA failed.
CertificateAuthorityConfiguration (dict) --
Your private CA configuration.
KeyAlgorithm (string) --
Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate. When you create a subordinate CA, you must use a key algorithm supported by the parent CA.
SigningAlgorithm (string) --
Name of the algorithm your private CA uses to sign certificate requests.
This parameter should not be confused with the SigningAlgorithm parameter used to sign certificates when they are issued.
Subject (dict) --
Structure that contains X.500 distinguished name information for your private CA.
Country (string) --
Two-digit code that specifies the country in which the certificate subject located.
Organization (string) --
Legal name of the organization with which the certificate subject is affiliated.
OrganizationalUnit (string) --
A subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated.
DistinguishedNameQualifier (string) --
Disambiguating information for the certificate subject.
State (string) --
State in which the subject of the certificate is located.
CommonName (string) --
Fully qualified domain name (FQDN) associated with the certificate subject.
SerialNumber (string) --
The certificate serial number.
Locality (string) --
The locality (such as a city or town) in which the certificate subject is located.
Title (string) --
A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the certificate subject.
Surname (string) --
Family name. In the US and the UK, for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first.
GivenName (string) --
First name.
Initials (string) --
Concatenation that typically contains the first letter of the GivenName , the first letter of the middle name if one exists, and the first letter of the SurName .
Pseudonym (string) --
Typically a shortened version of a longer GivenName . For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza.
GenerationQualifier (string) --
Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third.
RevocationConfiguration (dict) --
Information about the certificate revocation list (CRL) created and maintained by your private CA.
CrlConfiguration (dict) --
Configuration of the certificate revocation list (CRL), if any, maintained by your private CA.
Enabled (boolean) --
Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. You can use this value to enable certificate revocation for a new CA when you call the CreateCertificateAuthority action or for an existing CA when you call the UpdateCertificateAuthority action.
ExpirationInDays (integer) --
Number of days until a certificate expires.
CustomCname (string) --
Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public.
S3BucketName (string) --
Name of the S3 bucket that contains the CRL. If you do not provide a value for the CustomCname argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You can change the name of your bucket by calling the UpdateCertificateAuthority action. You must specify a bucket policy that allows ACM Private CA to write the CRL to your bucket.
RestorableUntil (datetime) --
The period during which a deleted CA can be restored. For more information, see the PermanentDeletionTimeInDays parameter of the DeleteCertificateAuthorityRequest action.
{'ResourceOwner': 'SELF | OTHER_ACCOUNTS'}
Response {'CertificateAuthorities': {'OwnerAccount': 'string'}}
Lists the private certificate authorities that you created by using the CreateCertificateAuthority action.
See also: AWS API Documentation
Request Syntax
client.list_certificate_authorities(
NextToken='string',
MaxResults=123,
ResourceOwner='SELF'|'OTHER_ACCOUNTS'
)
string
Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.
integer
Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.
string
Use this parameter to filter the returned set of certificate authorities based on their owner. The default is SELF.
dict
Response Syntax
{
'CertificateAuthorities': [
{
'Arn': 'string',
'OwnerAccount': 'string',
'CreatedAt': datetime(2015, 1, 1),
'LastStateChangeAt': datetime(2015, 1, 1),
'Type': 'ROOT'|'SUBORDINATE',
'Serial': 'string',
'Status': 'CREATING'|'PENDING_CERTIFICATE'|'ACTIVE'|'DELETED'|'DISABLED'|'EXPIRED'|'FAILED',
'NotBefore': datetime(2015, 1, 1),
'NotAfter': datetime(2015, 1, 1),
'FailureReason': 'REQUEST_TIMED_OUT'|'UNSUPPORTED_ALGORITHM'|'OTHER',
'CertificateAuthorityConfiguration': {
'KeyAlgorithm': 'RSA_2048'|'RSA_4096'|'EC_prime256v1'|'EC_secp384r1',
'SigningAlgorithm': 'SHA256WITHECDSA'|'SHA384WITHECDSA'|'SHA512WITHECDSA'|'SHA256WITHRSA'|'SHA384WITHRSA'|'SHA512WITHRSA',
'Subject': {
'Country': 'string',
'Organization': 'string',
'OrganizationalUnit': 'string',
'DistinguishedNameQualifier': 'string',
'State': 'string',
'CommonName': 'string',
'SerialNumber': 'string',
'Locality': 'string',
'Title': 'string',
'Surname': 'string',
'GivenName': 'string',
'Initials': 'string',
'Pseudonym': 'string',
'GenerationQualifier': 'string'
}
},
'RevocationConfiguration': {
'CrlConfiguration': {
'Enabled': True|False,
'ExpirationInDays': 123,
'CustomCname': 'string',
'S3BucketName': 'string'
}
},
'RestorableUntil': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
CertificateAuthorities (list) --
Summary information about each certificate authority you have created.
(dict) --
Contains information about your private certificate authority (CA). Your private CA can issue and revoke X.509 digital certificates. Digital certificates verify that the entity named in the certificate Subject field owns or controls the public key contained in the Subject Public Key Info field. Call the CreateCertificateAuthority action to create your private CA. You must then call the GetCertificateAuthorityCertificate action to retrieve a private CA certificate signing request (CSR). Sign the CSR with your ACM Private CA-hosted or on-premises root or subordinate CA certificate. Call the ImportCertificateAuthorityCertificate action to import the signed certificate into AWS Certificate Manager (ACM).
Arn (string) --
Amazon Resource Name (ARN) for your private certificate authority (CA). The format is 12345678-1234-1234-1234-123456789012 .
OwnerAccount (string) --
The AWS account ID that owns the certificate authority.
CreatedAt (datetime) --
Date and time at which your private CA was created.
LastStateChangeAt (datetime) --
Date and time at which your private CA was last updated.
Type (string) --
Type of your private CA.
Serial (string) --
Serial number of your private CA.
Status (string) --
Status of your private CA.
NotBefore (datetime) --
Date and time before which your private CA certificate is not valid.
NotAfter (datetime) --
Date and time after which your private CA certificate is not valid.
FailureReason (string) --
Reason the request to create your private CA failed.
CertificateAuthorityConfiguration (dict) --
Your private CA configuration.
KeyAlgorithm (string) --
Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate. When you create a subordinate CA, you must use a key algorithm supported by the parent CA.
SigningAlgorithm (string) --
Name of the algorithm your private CA uses to sign certificate requests.
This parameter should not be confused with the SigningAlgorithm parameter used to sign certificates when they are issued.
Subject (dict) --
Structure that contains X.500 distinguished name information for your private CA.
Country (string) --
Two-digit code that specifies the country in which the certificate subject located.
Organization (string) --
Legal name of the organization with which the certificate subject is affiliated.
OrganizationalUnit (string) --
A subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated.
DistinguishedNameQualifier (string) --
Disambiguating information for the certificate subject.
State (string) --
State in which the subject of the certificate is located.
CommonName (string) --
Fully qualified domain name (FQDN) associated with the certificate subject.
SerialNumber (string) --
The certificate serial number.
Locality (string) --
The locality (such as a city or town) in which the certificate subject is located.
Title (string) --
A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the certificate subject.
Surname (string) --
Family name. In the US and the UK, for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first.
GivenName (string) --
First name.
Initials (string) --
Concatenation that typically contains the first letter of the GivenName , the first letter of the middle name if one exists, and the first letter of the SurName .
Pseudonym (string) --
Typically a shortened version of a longer GivenName . For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza.
GenerationQualifier (string) --
Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third.
RevocationConfiguration (dict) --
Information about the certificate revocation list (CRL) created and maintained by your private CA.
CrlConfiguration (dict) --
Configuration of the certificate revocation list (CRL), if any, maintained by your private CA.
Enabled (boolean) --
Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. You can use this value to enable certificate revocation for a new CA when you call the CreateCertificateAuthority action or for an existing CA when you call the UpdateCertificateAuthority action.
ExpirationInDays (integer) --
Number of days until a certificate expires.
CustomCname (string) --
Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public.
S3BucketName (string) --
Name of the S3 bucket that contains the CRL. If you do not provide a value for the CustomCname argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You can change the name of your bucket by calling the UpdateCertificateAuthority action. You must specify a bucket policy that allows ACM Private CA to write the CRL to your bucket.
RestorableUntil (datetime) --
The period during which a deleted CA can be restored. For more information, see the PermanentDeletionTimeInDays parameter of the DeleteCertificateAuthorityRequest action.
NextToken (string) --
When the list is truncated, this value is present and should be used for the NextToken parameter in a subsequent pagination request.