# AWS::ACMPCA Construct Library

This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.

```ts
import * as acmpca from 'aws-cdk-lib/aws-acmpca';
```

## Certificate Authority

This package contains a [`CertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.CertificateAuthority) class.
At the moment, you cannot create new Authorities using it,
but you can import existing ones using the `fromCertificateAuthorityArn` static method:

```ts
const certificateAuthority = acmpca.CertificateAuthority.fromCertificateAuthorityArn(this, 'CA',
  'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77');
```

## Low-level `Cfn*` classes

You can always use the low-level classes
(starting with `Cfn*`) to create resources like the Certificate Authority:

```ts
const cfnCertificateAuthority = new acmpca.CfnCertificateAuthority(this, 'CA', {
  type: 'ROOT',
  keyAlgorithm: 'RSA_2048',
  signingAlgorithm: 'SHA256WITHRSA',
  subject: {
    country: 'US',
    organization: 'string',
    organizationalUnit: 'string',
    distinguishedNameQualifier: 'string',
    state: 'string',
    commonName: '123',
    serialNumber: 'string',
    locality: 'string',
    title: 'string',
    surname: 'string',
    givenName: 'string',
    initials: 'DG',
    pseudonym: 'string',
    generationQualifier: 'DBG',
  },
});
```

If you need to pass the higher-level [`ICertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.ICertificateAuthority) somewhere,
you can get it from the lower-level [`CfnCertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority) using the same `fromCertificateAuthorityArn` method:

```ts
declare const cfnCertificateAuthority: acmpca.CfnCertificateAuthority;

const certificateAuthority = acmpca.CertificateAuthority.fromCertificateAuthorityArn(this, 'CertificateAuthority',
  cfnCertificateAuthority.attrArn);
```

## Types

| Name | Kind | Summary |
| --- | --- | --- |
| [`CfnCertificate`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate) | Construct (L1) | The `AWS::ACMPCA::Certificate` resource is used to issue a certificate using your private certificate authority. |
| [`CfnCertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority) | Construct (L1) | Use the `AWS::ACMPCA::CertificateAuthority` resource to create a private CA. |
| [`CfnCertificateAuthorityActivation`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthorityActivation) | Construct (L1) | The `AWS::ACMPCA::CertificateAuthorityActivation` resource creates and installs a CA certificate on a CA. |
| [`CfnPermission`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnPermission) | Construct (L1) | Grants permissions to the Certificate Manager ( ACM ) service principal ( `acm.amazonaws.com` ) to perform [IssueCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html) , [GetCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificate.html) , and [ListPermissions](https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html) actions on a CA. These actions are needed for the ACM principal to renew private PKI certificates requested through ACM and residing in the same AWS account as the CA. |
| [`CertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.CertificateAuthority) | Class | Defines a Certificate for ACMPCA. |
| [`CfnCertificate.ApiPassthroughProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ApiPassthroughProperty) | Struct | Contains X.509 certificate information to be placed in an issued certificate. An `APIPassthrough` or `APICSRPassthrough` template variant must be selected, or else this parameter is ignored. |
| [`CfnCertificate.CustomAttributeProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.CustomAttributeProperty) | Struct | Defines the X.500 relative distinguished name (RDN). |
| [`CfnCertificate.CustomExtensionProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.CustomExtensionProperty) | Struct | Specifies the X.509 extension information for a certificate. |
| [`CfnCertificate.EdiPartyNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.EdiPartyNameProperty) | Struct | Describes an Electronic Data Interchange (EDI) entity as described in as defined in [Subject Alternative Name](https://docs.aws.amazon.com/https://datatracker.ietf.org/doc/html/rfc5280) in RFC 5280. |
| [`CfnCertificate.ExtendedKeyUsageProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ExtendedKeyUsageProperty) | Struct | Specifies additional purposes for which the certified public key may be used other than basic purposes indicated in the `KeyUsage` extension. |
| [`CfnCertificate.ExtensionsProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ExtensionsProperty) | Struct | Contains X.509 extension information for a certificate. |
| [`CfnCertificate.GeneralNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.GeneralNameProperty) | Struct | Describes an ASN.1 X.400 `GeneralName` as defined in [RFC 5280](https://docs.aws.amazon.com/https://datatracker.ietf.org/doc/html/rfc5280) . Only one of the following naming options should be provided. Providing more than one option results in an `InvalidArgsException` error. |
| [`CfnCertificate.KeyUsageProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.KeyUsageProperty) | Struct | Defines one or more purposes for which the key contained in the certificate can be used. |
| [`CfnCertificate.OtherNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.OtherNameProperty) | Struct | Defines a custom ASN.1 X.400 `GeneralName` using an object identifier (OID) and value. The OID must satisfy the regular expression shown below. For more information, see NIST's definition of [Object Identifier (OID)](https://docs.aws.amazon.com/https://csrc.nist.gov/glossary/term/Object_Identifier) . |
| [`CfnCertificate.PolicyInformationProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.PolicyInformationProperty) | Struct | Defines the X.509 `CertificatePolicies` extension. |
| [`CfnCertificate.PolicyQualifierInfoProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.PolicyQualifierInfoProperty) | Struct | Modifies the `CertPolicyId` of a `PolicyInformation` object with a qualifier. |
| [`CfnCertificate.QualifierProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.QualifierProperty) | Struct | Defines a `PolicyInformation` qualifier. |
| [`CfnCertificate.SubjectProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.SubjectProperty) | Struct | Contains information about the certificate subject. |
| [`CfnCertificate.ValidityProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ValidityProperty) | Struct | Length of time for which the certificate issued by your private certificate authority (CA), or by the private CA itself, is valid in days, months, or years. |
| [`CfnCertificateAuthority.AccessDescriptionProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.AccessDescriptionProperty) | Struct | Provides access information used by the `authorityInfoAccess` and `subjectInfoAccess` extensions described in [RFC 5280](https://docs.aws.amazon.com/https://datatracker.ietf.org/doc/html/rfc5280) . |
| [`CfnCertificateAuthority.AccessMethodProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.AccessMethodProperty) | Struct | Describes the type and format of extension access. |
| [`CfnCertificateAuthority.CrlConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.CrlConfigurationProperty) | Struct | Contains configuration information for a certificate revocation list (CRL). |
| [`CfnCertificateAuthority.CrlDistributionPointExtensionConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.CrlDistributionPointExtensionConfigurationProperty) | Struct | Contains configuration information for the default behavior of the CRL Distribution Point (CDP) extension in certificates issued by your CA. |
| [`CfnCertificateAuthority.CsrExtensionsProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.CsrExtensionsProperty) | Struct | Describes the certificate extensions to be added to the certificate signing request (CSR). |
| [`CfnCertificateAuthority.CustomAttributeProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.CustomAttributeProperty) | Struct | Defines the X.500 relative distinguished name (RDN). |
| [`CfnCertificateAuthority.EdiPartyNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.EdiPartyNameProperty) | Struct | Describes an Electronic Data Interchange (EDI) entity as described in as defined in [Subject Alternative Name](https://docs.aws.amazon.com/https://datatracker.ietf.org/doc/html/rfc5280) in RFC 5280. |
| [`CfnCertificateAuthority.GeneralNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.GeneralNameProperty) | Struct | Describes an ASN.1 X.400 `GeneralName` as defined in [RFC 5280](https://docs.aws.amazon.com/https://datatracker.ietf.org/doc/html/rfc5280) . Only one of the following naming options should be provided. Providing more than one option results in an `InvalidArgsException` error. |
| [`CfnCertificateAuthority.KeyUsageProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.KeyUsageProperty) | Struct | Defines one or more purposes for which the key contained in the certificate can be used. |
| [`CfnCertificateAuthority.OcspConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.OcspConfigurationProperty) | Struct | Contains information to enable and configure Online Certificate Status Protocol (OCSP) for validating certificate revocation status. |
| [`CfnCertificateAuthority.OtherNameProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.OtherNameProperty) | Struct | Defines a custom ASN.1 X.400 `GeneralName` using an object identifier (OID) and value. The OID must satisfy the regular expression shown below. For more information, see NIST's definition of [Object Identifier (OID)](https://docs.aws.amazon.com/https://csrc.nist.gov/glossary/term/Object_Identifier) . |
| [`CfnCertificateAuthority.RevocationConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.RevocationConfigurationProperty) | Struct | Certificate revocation information used by the [CreateCertificateAuthority](https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html) and [UpdateCertificateAuthority](https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html) actions. Your private certificate authority (CA) can configure Online Certificate Status Protocol (OCSP) support and/or maintain a certificate revocation list (CRL). OCSP returns validation information about certificates as requested by clients, and a CRL contains an updated list of certificates revoked by your CA. For more information, see [RevokeCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html) in the *AWS Private CA API Reference* and [Setting up a certificate revocation method](https://docs.aws.amazon.com/privateca/latest/userguide/revocation-setup.html) in the *AWS Private CA User Guide* . |
| [`CfnCertificateAuthority.SubjectProperty`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthority.SubjectProperty) | Struct | ASN1 subject for the certificate authority. |
| [`CfnCertificateAuthorityActivationProps`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthorityActivationProps) | Struct | Properties for defining a `CfnCertificateAuthorityActivation`. |
| [`CfnCertificateAuthorityProps`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateAuthorityProps) | Struct | Properties for defining a `CfnCertificateAuthority`. |
| [`CfnCertificateProps`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificateProps) | Struct | Properties for defining a `CfnCertificate`. |
| [`CfnPermissionProps`](/v2/docs/aws-cdk-lib.aws_acmpca.CfnPermissionProps) | Struct | Properties for defining a `CfnPermission`. |
| [`ICertificateAuthority`](/v2/docs/aws-cdk-lib.aws_acmpca.ICertificateAuthority) | Interface | Interface which all CertificateAuthority based class must implement. |