AWS Certificate Manager Private Certificate Authority
User Guide (Version latest)

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.

CreatePermission

The following Java sample shows how to use the CreatePermission operation.

The operation assigns access permissions from a private CA to a designated AWS service principal. Services can be given permission to create and retrieve certificates from a private CA, as well as list the active permissions that the private CA has granted. In order to automatically renew certificates through ACM, you must assign all possible permissions (IssueCertificate, GetCertificate, and ListPermissions) from the CA to the ACM service principal (acm.amazonaws.com). You can find a CA's ARN by calling the ListCertificateAuthorities function.

Once a permission is created, you can inspect it with the ListPermissions function or delete it with the DeletePermission function.

package com.amazonaws.samples; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.client.builder.AwsClientBuilder; import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration; import com.amazonaws.AmazonClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import com.amazonaws.services.acmpca.AWSACMPCA; import com.amazonaws.services.acmpca.AWSACMPCAClientBuilder; import com.amazonaws.services.acmpca.model.CreatePermissionRequest; import com.amazonaws.services.acmpca.model.CreatePermissionResult; import com.amazonaws.services.acmpca.model.InvalidArnException; import com.amazonaws.services.acmpca.model.InvalidStateException; import com.amazonaws.services.acmpca.model.LimitExceededException; import com.amazonaws.services.acmpca.model.PermissionAlreadyExistsException; import com.amazonaws.services.acmpca.model.RequestFailedException; import com.amazonaws.services.acmpca.model.ResourceNotFoundException; public class CreatePermission { public static void main(String[] args) throws Exception { // Retrieve your credentials from the C:\Users\name\.aws\credentials file // in Windows or the .aws/credentials file in Linux. AWSCredentials credentials = null; try{ credentials = new ProfileCredentialsProvider("default").getCredentials(); } catch (Exception e) { throw new AmazonClientException("Cannot load your credentials from file.", e); } // Define the endpoint for your sample. String endpointProtocol = "https://acm-pca.region.amazonaws.com/"; String endpointRegion = "region"; EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(endpointProtocol, endpointRegion); // Create a client that you can use to make requests. AWSACMPCA client = AWSACMPCAClientBuilder.standard() .withEndpointConfiguration(endpoint) .withCredentials(new AWSStaticCredentialsProvider(credentials)) .build(); // Create a request object. CreatePermissionRequest req = new CreatePermissionRequest(); // Set the certificate authority ARN. req.setCertificateAuthorityArn("arn:aws:acm-pca:region:account:" + "certificate-authority/12345678-1234-1234-1234-123456789012"); // Set the permissions to give the user. req.setActions(["IssueCertificate", "GetCertificate", "ListPermissions"]); // Set the AWS principal. req.setPrincipal("acm.amazonaws.com"); // Create a result object. CreatePermissionsResult result = null; try { result = client.createPermission(req); } catch(InvalidArnException ex) { throw ex; } catch(InvalidStateException ex) { throw ex; } catch(LimitExceededException ex) { throw ex; } catch(PermissionAlreadyExistsException ex) { throw ex; } catch(RequestFailedException ex) { throw ex; } catch(ResourceNotFoundException ex) { throw ex; } } }