Skip to content

Commit 70a55d5

Browse files
author
awstools
committed
docs(client-acm-pca): Documentation updates for AWS Private CA.
1 parent a5a89e3 commit 70a55d5

File tree

4 files changed

+59
-73
lines changed

4 files changed

+59
-73
lines changed

‎clients/client-acm-pca/src/commands/CreateCertificateAuthorityAuditReportCommand.ts

+3-10
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,9 @@ export interface CreateCertificateAuthorityAuditReportCommandOutput
3737
__MetadataBearer {}
3838

3939
/**
40-
* <p>Creates an audit report that lists every time that your CA private key is used. The
41-
* report is saved in the Amazon S3 bucket that you specify on input. The <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html">IssueCertificate</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html">RevokeCertificate</a> actions use
42-
* the private key. </p>
43-
* <note>
44-
* <p>Both Amazon Web Services Private CA and the IAM principal must have permission to write to
45-
* the S3 bucket that you specify. If the IAM principal making the call
46-
* does not have permission to write to the bucket, then an exception is
47-
* thrown. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#s3-policies">Access
48-
* policies for CRLs in Amazon S3</a>.</p>
49-
* </note>
40+
* <p>Creates an audit report that lists every time that your CA private key is used to issue a certificate. The <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html">IssueCertificate</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html">RevokeCertificate</a> actions use
41+
* the private key.</p>
42+
* <p>To save the audit report to your designated Amazon S3 bucket, you must create a bucket policy that grants Amazon Web Services Private CA permission to access and write to it. For an example policy, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaAuditReport.html#s3-access">Prepare an Amazon S3 bucket for audit reports</a>.</p>
5043
* <p>Amazon Web Services Private CA assets that are stored in Amazon S3 can be protected with encryption.
5144
* For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaAuditReport.html#audit-report-encryption">Encrypting Your Audit
5245
* Reports</a>.</p>

‎clients/client-acm-pca/src/commands/ImportCertificateAuthorityCertificateCommand.ts

+17-19
Original file line numberDiff line numberDiff line change
@@ -102,64 +102,62 @@ export interface ImportCertificateAuthorityCertificateCommandOutput extends __Me
102102
* certificate or chain.</p>
103103
* <ul>
104104
* <li>
105-
* <p>Basic constraints (<i>must</i> be marked critical)</p>
105+
* <p>Authority key identifier</p>
106106
* </li>
107107
* <li>
108-
* <p>Subject alternative names</p>
108+
* <p>Basic constraints (<i>must</i> be marked critical)</p>
109109
* </li>
110110
* <li>
111-
* <p>Key usage</p>
111+
* <p>Certificate policies</p>
112112
* </li>
113113
* <li>
114114
* <p>Extended key usage</p>
115115
* </li>
116116
* <li>
117-
* <p>Authority key identifier</p>
117+
* <p>Inhibit anyPolicy</p>
118118
* </li>
119119
* <li>
120-
* <p>Subject key identifier</p>
120+
* <p>Issuer alternative name</p>
121121
* </li>
122122
* <li>
123-
* <p>Issuer alternative name</p>
123+
* <p>Key usage</p>
124124
* </li>
125125
* <li>
126-
* <p>Subject directory attributes</p>
126+
* <p>Name constraints</p>
127127
* </li>
128128
* <li>
129-
* <p>Subject information access</p>
129+
* <p>Policy mappings</p>
130130
* </li>
131131
* <li>
132-
* <p>Certificate policies</p>
132+
* <p>Subject alternative name</p>
133133
* </li>
134134
* <li>
135-
* <p>Policy mappings</p>
135+
* <p>Subject directory attributes</p>
136136
* </li>
137137
* <li>
138-
* <p>Inhibit anyPolicy</p>
138+
* <p>Subject key identifier</p>
139+
* </li>
140+
* <li>
141+
* <p>Subject information access</p>
139142
* </li>
140143
* </ul>
141144
* <p>Amazon Web Services Private CA rejects the following extensions when they are marked critical in an
142145
* imported CA certificate or chain.</p>
143146
* <ul>
144147
* <li>
145-
* <p>Name constraints</p>
146-
* </li>
147-
* <li>
148-
* <p>Policy constraints</p>
148+
* <p>Authority information access</p>
149149
* </li>
150150
* <li>
151151
* <p>CRL distribution points</p>
152152
* </li>
153153
* <li>
154-
* <p>Authority information access</p>
155-
* </li>
156-
* <li>
157154
* <p>Freshest CRL</p>
158155
* </li>
159156
* <li>
160-
* <p>Any other extension</p>
157+
* <p>Policy constraints</p>
161158
* </li>
162159
* </ul>
160+
* <p>Amazon Web Services Private Certificate Authority will also reject any other extension marked as critical not contained on the preceding list of allowed extensions.</p>
163161
* @example
164162
* Use a bare-bones client and the command you need to make an API call.
165163
* ```javascript

‎clients/client-acm-pca/src/models/models_0.ts

+35-40
Original file line numberDiff line numberDiff line change
@@ -818,33 +818,29 @@ export interface CreateCertificateAuthorityRequest {
818818
CertificateAuthorityConfiguration: CertificateAuthorityConfiguration | undefined;
819819

820820
/**
821-
* <p>Contains information to enable Online Certificate Status Protocol (OCSP) support, to
822-
* enable a certificate revocation list (CRL), to enable both, or to enable neither. The
823-
* default is for both certificate validation mechanisms to be disabled. </p>
824-
* <note>
825-
* <p>The following requirements apply to revocation configurations.</p>
826-
* <ul>
827-
* <li>
828-
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
821+
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. By default, both certificate validation mechanisms are disabled.</p>
822+
* <p>The following requirements apply to revocation configurations.</p>
823+
* <ul>
824+
* <li>
825+
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
829826
* parameter, and will fail if other parameters such as <code>CustomCname</code> or
830827
* <code>ExpirationInDays</code> are included.</p>
831-
* </li>
832-
* <li>
833-
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
828+
* </li>
829+
* <li>
830+
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
834831
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3
835832
* bucket naming rules</a>.</p>
836-
* </li>
837-
* <li>
838-
* <p>A configuration containing a custom Canonical
833+
* </li>
834+
* <li>
835+
* <p>A configuration containing a custom Canonical
839836
* Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions
840837
* on the use of special characters in a CNAME. </p>
841-
* </li>
842-
* <li>
843-
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
838+
* </li>
839+
* <li>
840+
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
844841
* protocol prefix such as "http://" or "https://".</p>
845-
* </li>
846-
* </ul>
847-
* </note>
842+
* </li>
843+
* </ul>
848844
* <p> For more information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a>
849845
* types.</p>
850846
* @public
@@ -2716,34 +2712,33 @@ export interface UpdateCertificateAuthorityRequest {
27162712
CertificateAuthorityArn: string | undefined;
27172713

27182714
/**
2719-
* <p>Contains information to enable Online Certificate Status Protocol (OCSP) support, to
2720-
* enable a certificate revocation list (CRL), to enable both, or to enable neither. If
2721-
* this parameter is not supplied, existing capibilites remain unchanged. For more
2715+
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. If you don't supply this parameter, existing capibilites remain unchanged. For more
27222716
* information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a> types.</p>
2723-
* <note>
2724-
* <p>The following requirements apply to revocation configurations.</p>
2725-
* <ul>
2726-
* <li>
2727-
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
2717+
* <p>The following requirements apply to revocation configurations.</p>
2718+
* <ul>
2719+
* <li>
2720+
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
27282721
* parameter, and will fail if other parameters such as <code>CustomCname</code> or
27292722
* <code>ExpirationInDays</code> are included.</p>
2730-
* </li>
2731-
* <li>
2732-
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
2723+
* </li>
2724+
* <li>
2725+
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
27332726
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3
27342727
* bucket naming rules</a>.</p>
2735-
* </li>
2736-
* <li>
2737-
* <p>A configuration containing a custom Canonical
2728+
* </li>
2729+
* <li>
2730+
* <p>A configuration containing a custom Canonical
27382731
* Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions
27392732
* on the use of special characters in a CNAME. </p>
2740-
* </li>
2741-
* <li>
2742-
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
2733+
* </li>
2734+
* <li>
2735+
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
27432736
* protocol prefix such as "http://" or "https://".</p>
2744-
* </li>
2745-
* </ul>
2746-
* </note>
2737+
* </li>
2738+
* </ul>
2739+
* <important>
2740+
* <p> If you update the <code>S3BucketName</code> of <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a>, you can break revocation for existing certificates. In other words, if you call <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> to update the CRL configuration's S3 bucket name, Amazon Web Services Private CA only writes CRLs to the new S3 bucket. Certificates issued prior to this point will have the old S3 bucket name in your CRL Distribution Point (CDP) extension, essentially breaking revocation. If you must update the S3 bucket, you'll need to reissue old certificates to keep the revocation working. Alternatively, you can use a <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html#privateca-Type-CrlConfiguration-CustomCname">CustomCname</a> in your CRL configuration if you might need to change the S3 bucket name in the future.</p>
2741+
* </important>
27472742
* @public
27482743
*/
27492744
RevocationConfiguration?: RevocationConfiguration;

0 commit comments

Comments
 (0)