AWS Certificate Manager Private Certificate Authority
AWS Private Certificate Authority Documentation (API Version 2017-08-22)


Permissions designate which private CA operations can be performed by an AWS service or entity. In order for ACM to automatically renew private certificates, you must give the ACM service principal all available permissions (IssueCertificate, GetCertificate, and ListPermissions). Permissions can be assigned with the CreatePermission operation, removed with the DeletePermission operation, and listed with the ListPermissions operation.



The private CA operations that can be performed by the designated AWS service.

Type: Array of strings

Array Members: Minimum number of 1 item. Maximum number of 3 items.

Valid Values: IssueCertificate | GetCertificate | ListPermissions

Required: No


The Amazon Resource Number (ARN) of the private CA from which the permission was issued.

Type: String

Length Constraints: Minimum length of 5. Maximum length of 200.

Pattern: arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]+:[\w+=,.@-]+(/[\w+=/,.@-]+)*

Required: No


The time at which the permission was created.

Type: Timestamp

Required: No


The name of the policy that is associated with the permission.

Type: String

Required: No


The AWS service or entity that holds the permission. At this time, the only valid principal is

Type: String

Required: No


The ID of the account that assigned the permission.

Type: String

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following:

On this page: