Resource: awsAcmpcaCertificateAuthority
Provides a resource to manage AWS Certificate Manager Private Certificate Authorities (ACM PCA Certificate Authorities).
\~> NOTE: Creating this resource will leave the certificate authority in a PENDING_CERTIFICATE status, which means it cannot yet issue certificates. To complete this setup, you must fully sign the certificate authority CSR available in the certificateSigningRequest attribute. The awsAcmpcaCertificateAuthorityCertificate resource can be used for this purpose.
Example Usage
Basic
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
new aws.acmpcaCertificateAuthority.AcmpcaCertificateAuthority(this, "example", {
certificateAuthorityConfiguration: {
keyAlgorithm: "RSA_4096",
signingAlgorithm: "SHA512WITHRSA",
subject: {
commonName: "example.com",
},
},
permanentDeletionTimeInDays: 7,
});
Short-lived certificate
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
new aws.acmpcaCertificateAuthority.AcmpcaCertificateAuthority(this, "example", {
certificateAuthorityConfiguration: {
keyAlgorithm: "RSA_4096",
signingAlgorithm: "SHA512WITHRSA",
subject: {
commonName: "example.com",
},
},
usageMode: "SHORT_LIVED_CERTIFICATE",
});
Enable Certificate Revocation List
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsS3BucketExample = new aws.s3Bucket.S3Bucket(this, "example", {
bucket: "example",
});
const dataAwsIamPolicyDocumentAcmpcaBucketAccess =
new aws.dataAwsIamPolicyDocument.DataAwsIamPolicyDocument(
this,
"acmpca_bucket_access",
{
statement: [
{
actions: [
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:PutObject",
"s3:PutObjectAcl",
],
principals: [
{
identifiers: ["acm-pca.amazonaws.com"],
type: "Service",
},
],
resources: [
awsS3BucketExample.arn,
`\${${awsS3BucketExample.arn}}/*`,
],
},
],
}
);
const awsS3BucketPolicyExample = new aws.s3BucketPolicy.S3BucketPolicy(
this,
"example_2",
{
bucket: awsS3BucketExample.id,
policy: dataAwsIamPolicyDocumentAcmpcaBucketAccess.json,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsS3BucketPolicyExample.overrideLogicalId("example");
const awsAcmpcaCertificateAuthorityExample =
new aws.acmpcaCertificateAuthority.AcmpcaCertificateAuthority(
this,
"example_3",
{
certificateAuthorityConfiguration: {
keyAlgorithm: "RSA_4096",
signingAlgorithm: "SHA512WITHRSA",
subject: {
commonName: "example.com",
},
},
depends_on: [`\${${awsS3BucketPolicyExample.fqn}}`],
revocationConfiguration: {
crlConfiguration: {
customCname: "crl.example.com",
enabled: true,
expirationInDays: 7,
s3BucketName: awsS3BucketExample.id,
},
},
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsAcmpcaCertificateAuthorityExample.overrideLogicalId("example");
Argument Reference
The following arguments are supported:
certificateAuthorityConfiguration- (Required) Nested argument containing algorithms and certificate subject information. Defined below.enabled- (Optional) Whether the certificate authority is enabled or disabled. Defaults totrue. Can only be disabled if the CA is in anactivestate.revocationConfiguration- (Optional) Nested argument containing revocation configuration. Defined below.usageMode- (Optional) Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults toGENERAL_PURPOSE. Valid values:GENERAL_PURPOSEandSHORT_LIVED_CERTIFICATE.tags- (Optional) Key-value map of user-defined tags that are attached to the certificate authority. If configured with a providerdefaultTagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.type- (Optional) Type of the certificate authority. Defaults tosubordinate. Valid values:rootandsubordinate.permanentDeletionTimeInDays- (Optional) Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days.
certificateAuthorityConfiguration
keyAlgorithm- (Required) Type of the public key algorithm and size, in bits, of the key pair that your key pair creates when it issues a certificate. Valid values can be found in the ACM PCA Documentation.signingAlgorithm- (Required) Name of the algorithm your private CA uses to sign certificate requests. Valid values can be found in the ACM PCA Documentation.subject- (Required) Nested argument that contains X.500 distinguished name information. At least one nested attribute must be specified.
subject
Contains information about the certificate subject. Identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service.
commonName- (Optional) Fully qualified domain name (FQDN) associated with the certificate subject. Must be less than or equal to 64 characters in length.country- (Optional) Two digit code that specifies the country in which the certificate subject located. Must be less than or equal to 2 characters in length.distinguishedNameQualifier- (Optional) Disambiguating information for the certificate subject. Must be less than or equal to 64 characters in length.generationQualifier- (Optional) Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third. Must be less than or equal to 3 characters in length.givenName- (Optional) First name. Must be less than or equal to 16 characters in length.initials- (Optional) Concatenation that typically contains the first letter of thegivenName, the first letter of the middle name if one exists, and the first letter of thesurname. Must be less than or equal to 5 characters in length.locality- (Optional) Locality (such as a city or town) in which the certificate subject is located. Must be less than or equal to 128 characters in length.organization- (Optional) Legal name of the organization with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.organizationalUnit- (Optional) Subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.pseudonym- (Optional) Typically a shortened version of a longergivenName. For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza. Must be less than or equal to 128 characters in length.state- (Optional) State in which the subject of the certificate is located. Must be less than or equal to 128 characters in length.surname- (Optional) Family name. In the US and the UK for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first. Must be less than or equal to 40 characters in length.title- (Optional) Title such as Mr. or Ms. which is pre-pended to the name to refer formally to the certificate subject. Must be less than or equal to 64 characters in length.
revocationConfiguration
crlConfiguration- (Optional) Nested argument containing configuration of the certificate revocation list (CRL), if any, maintained by the certificate authority. Defined below.ocspConfiguration- (Optional) Nested argument containing configuration of the custom OCSP responder endpoint. Defined below.
crlConfiguration
customCname- (Optional) Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public. Must be less than or equal to 253 characters in length.enabled- (Optional) Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. Defaults tofalse.expirationInDays- (Optional, Required ifenabledistrue) Number of days until a certificate expires. Must be between 1 and 5000.s3BucketName- (Optional, Required ifenabledistrue) Name of the S3 bucket that contains the CRL. If you do not provide a value for thecustomCnameargument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You must specify a bucket policy that allows ACM PCA to write the CRL to your bucket. Must be between 3 and 255 characters in length.s3ObjectAcl- (Optional) Determines whether the CRL will be publicly readable or privately held in the CRL Amazon S3 bucket. Defaults toPUBLIC_READ.
ocspConfiguration
enabled- (Required) Boolean value that specifies whether a custom OCSP responder is enabled.ocspCustomCname- (Optional) CNAME specifying a customized OCSP domain. Note: The value of the CNAME must not include a protocol prefix such as "http://" or "https://".
Attributes Reference
In addition to all arguments above, the following attributes are exported:
id- ARN of the certificate authority.arn- ARN of the certificate authority.certificate- Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.certificateChain- Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported.certificateSigningRequest- The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.notAfter- Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.notBefore- Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.serial- Serial number of the certificate authority. Only available after the certificate authority certificate has been imported.status- (Deprecated use theenabledattribute instead) Status of the certificate authority.tagsAll- Map of tags assigned to the resource, including those inherited from the providerdefaultTagsconfiguration block.
Timeouts
create- (Default1M)
Import
awsAcmpcaCertificateAuthority can be imported by using the certificate authority ARN, e.g.,