AWS SDK for PHP 3.x

Client: Aws\PcaConnectorAd\PcaConnectorAdClient

Service ID: pca-connector-ad

Version: 2018-05-10

This page describes the parameters and results for the operations of the PcaConnectorAd (2018-05-10), and shows how to use the Aws\PcaConnectorAd\PcaConnectorAdClient object to call the described operations. This documentation is specific to the 2018-05-10 API version of the service.

Operation Summary

Each of the following operations can be created from a client using $client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

CreateConnector ( array $params = [] ): Creates a connector between Amazon Web Services Private CA and an Active Directory.
CreateDirectoryRegistration ( array $params = [] ): Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory
CreateServicePrincipalName ( array $params = [] ): Creates a service principal name (SPN) for the service account in Active Directory.
CreateTemplate ( array $params = [] ): Creates an Active Directory compatible certificate template.
CreateTemplateGroupAccessControlEntry ( array $params = [] ): Create a group access control entry.
DeleteConnector ( array $params = [] ): Deletes a connector for Active Directory.
DeleteDirectoryRegistration ( array $params = [] ): Deletes a directory registration.
DeleteServicePrincipalName ( array $params = [] ): Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.
DeleteTemplate ( array $params = [] ): Deletes a template.
DeleteTemplateGroupAccessControlEntry ( array $params = [] ): Deletes a group access control entry.
GetConnector ( array $params = [] ): Lists information about your connector.
GetDirectoryRegistration ( array $params = [] ): A structure that contains information about your directory registration.
GetServicePrincipalName ( array $params = [] ): Lists the service principal name that the connector uses to authenticate with Active Directory.
GetTemplate ( array $params = [] ): Retrieves a certificate template that the connector uses to issue certificates from a private CA.
GetTemplateGroupAccessControlEntry ( array $params = [] ): Retrieves the group access control entries for a template.
ListConnectors ( array $params = [] ): Lists the connectors that you created by using the https://docs.
ListDirectoryRegistrations ( array $params = [] ): Lists the directory registrations that you created by using the https://docs.
ListServicePrincipalNames ( array $params = [] ): Lists the service principal names that the connector uses to authenticate with Active Directory.
ListTagsForResource ( array $params = [] ): Lists the tags, if any, that are associated with your resource.
ListTemplateGroupAccessControlEntries ( array $params = [] ): Lists group access control entries you created.
ListTemplates ( array $params = [] ): Lists the templates, if any, that are associated with a connector.
TagResource ( array $params = [] ): Adds one or more tags to your resource.
UntagResource ( array $params = [] ): Removes one or more tags from your resource.
UpdateTemplate ( array $params = [] ): Update template configuration to define the information included in certificates.
UpdateTemplateGroupAccessControlEntry ( array $params = [] ): Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListConnectors
ListDirectoryRegistrations
ListServicePrincipalNames
ListTemplateGroupAccessControlEntries
ListTemplates

Operations

CreateConnector

$result = $client->createConnector([/* ... */]);
$promise = $client->createConnectorAsync([/* ... */]);

Creates a connector between Amazon Web Services Private CA and an Active Directory. You must specify the private CA, directory ID, and security groups.

Parameter Syntax

$result = $client->createConnector([
    'CertificateAuthorityArn' => '<string>', // REQUIRED
    'ClientToken' => '<string>',
    'DirectoryId' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
    'VpcInformation' => [ // REQUIRED
        'SecurityGroupIds' => ['<string>', ...], // REQUIRED
    ],
]);

Parameter Details

Members

CertificateAuthorityArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

ClientToken

: Type: string

Idempotency token.

DirectoryId

: Required: Yes
: Type: string

The identifier of the Active Directory.

Tags

: Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a connector consisting of a key-value pair.

VpcInformation

: Required: Yes
: Type: VpcInformation structure

Security group IDs that describe the inbound and outbound rules.

Result Syntax

[
    'ConnectorArn' => '<string>',
]

Result Details

Members

ConnectorArn

: Type: string

If successful, the Amazon Resource Name (ARN) of the connector for Active Directory.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:: Request would cause a service quota to be exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateDirectoryRegistration

$result = $client->createDirectoryRegistration([/* ... */]);
$promise = $client->createDirectoryRegistrationAsync([/* ... */]);

Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory

Parameter Syntax

$result = $client->createDirectoryRegistration([
    'ClientToken' => '<string>',
    'DirectoryId' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Members

ClientToken

: Type: string

Idempotency token.

DirectoryId

: Required: Yes
: Type: string

The identifier of the Active Directory.

Tags

: Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[
    'DirectoryRegistrationArn' => '<string>',
]

Result Details

Members

DirectoryRegistrationArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateServicePrincipalName

$result = $client->createServicePrincipalName([/* ... */]);
$promise = $client->createServicePrincipalNameAsync([/* ... */]);

Creates a service principal name (SPN) for the service account in Active Directory. Kerberos authentication uses SPNs to associate a service instance with a service sign-in account.

Parameter Syntax

$result = $client->createServicePrincipalName([
    'ClientToken' => '<string>',
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ClientToken

: Type: string

Idempotency token.

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplate

$result = $client->createTemplate([/* ... */]);
$promise = $client->createTemplateAsync([/* ... */]);

Creates an Active Directory compatible certificate template. The connectors issues certificates using these templates based on the requester’s Active Directory group membership.

Parameter Syntax

$result = $client->createTemplate([
    'ClientToken' => '<string>',
    'ConnectorArn' => '<string>', // REQUIRED
    'Definition' => [ // REQUIRED
        'TemplateV2' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'PrivateKeyAttributes' => [ // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV3' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [ // REQUIRED
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV4' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512',
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'RequireSameKeyRenewal' => true || false,
                'StrongKeyProtectionRequired' => true || false,
                'UseLegacyProvider' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
    ],
    'Name' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Members

ClientToken

: Type: string

Idempotency token.

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Definition

: Required: Yes
: Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Name

: Required: Yes
: Type: string

Name of the template. The template name must be unique.

Tags

: Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a template consisting of a key-value pair.

Result Syntax

[
    'TemplateArn' => '<string>',
]

Result Details

Members

TemplateArn

: Type: string

If successful, the Amazon Resource Name (ARN) of the template.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:: Request would cause a service quota to be exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplateGroupAccessControlEntry

$result = $client->createTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->createTemplateGroupAccessControlEntryAsync([/* ... */]);

Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).

Parameter Syntax

$result = $client->createTemplateGroupAccessControlEntry([
    'AccessRights' => [ // REQUIRED
        'AutoEnroll' => 'ALLOW|DENY',
        'Enroll' => 'ALLOW|DENY',
    ],
    'ClientToken' => '<string>',
    'GroupDisplayName' => '<string>', // REQUIRED
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

AccessRights

: Required: Yes
: Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

ClientToken

: Type: string

Idempotency token.

GroupDisplayName

: Required: Yes
: Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

: Required: Yes
: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:: Request would cause a service quota to be exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteConnector

$result = $client->deleteConnector([/* ... */]);
$promise = $client->deleteConnectorAsync([/* ... */]);

Deletes a connector for Active Directory. You must provide the Amazon Resource Name (ARN) of the connector that you want to delete. You can find the ARN by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_ListConnectors action. Deleting a connector does not deregister your directory with Amazon Web Services Private CA. You can deregister your directory by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_DeleteDirectoryRegistration action.

Parameter Syntax

$result = $client->deleteConnector([
    'ConnectorArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteDirectoryRegistration

$result = $client->deleteDirectoryRegistration([/* ... */]);
$promise = $client->deleteDirectoryRegistrationAsync([/* ... */]);

Deletes a directory registration. Deleting a directory registration deauthorizes Amazon Web Services Private CA with the directory.

Parameter Syntax

$result = $client->deleteDirectoryRegistration([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteServicePrincipalName

$result = $client->deleteServicePrincipalName([/* ... */]);
$promise = $client->deleteServicePrincipalNameAsync([/* ... */]);

Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.

Parameter Syntax

$result = $client->deleteServicePrincipalName([
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplate

$result = $client->deleteTemplate([/* ... */]);
$promise = $client->deleteTemplateAsync([/* ... */]);

Deletes a template. Certificates issued using the template are still valid until they are revoked or expired.

Parameter Syntax

$result = $client->deleteTemplate([
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplateGroupAccessControlEntry

$result = $client->deleteTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->deleteTemplateGroupAccessControlEntryAsync([/* ... */]);

Deletes a group access control entry.

Parameter Syntax

$result = $client->deleteTemplateGroupAccessControlEntry([
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

GroupSecurityIdentifier

: Required: Yes
: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

GetConnector

$result = $client->getConnector([/* ... */]);
$promise = $client->getConnectorAsync([/* ... */]);

Lists information about your connector. You specify the connector on input by its ARN (Amazon Resource Name).

Parameter Syntax

$result = $client->getConnector([
    'ConnectorArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[
    'Connector' => [
        'Arn' => '<string>',
        'CertificateAuthorityArn' => '<string>',
        'CertificateEnrollmentPolicyServerEndpoint' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryId' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND',
        'UpdatedAt' => <DateTime>,
        'VpcInformation' => [
            'SecurityGroupIds' => ['<string>', ...],
        ],
    ],
]

Result Details

Members

Connector

: Type: Connector structure

A structure that contains information about your connector.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

GetDirectoryRegistration

$result = $client->getDirectoryRegistration([/* ... */]);
$promise = $client->getDirectoryRegistrationAsync([/* ... */]);

A structure that contains information about your directory registration.

Parameter Syntax

$result = $client->getDirectoryRegistration([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[
    'DirectoryRegistration' => [
        'Arn' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryId' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

DirectoryRegistration

: Type: DirectoryRegistration structure

The directory registration represents the authorization of the connector service with a directory.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

GetServicePrincipalName

$result = $client->getServicePrincipalName([/* ... */]);
$promise = $client->getServicePrincipalNameAsync([/* ... */]);

Lists the service principal name that the connector uses to authenticate with Active Directory.

Parameter Syntax

$result = $client->getServicePrincipalName([
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[
    'ServicePrincipalName' => [
        'ConnectorArn' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryRegistrationArn' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|INTERNAL_FAILURE',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

ServicePrincipalName

: Type: ServicePrincipalName structure

The service principal name that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplate

$result = $client->getTemplate([/* ... */]);
$promise = $client->getTemplateAsync([/* ... */]);

Retrieves a certificate template that the connector uses to issue certificates from a private CA.

Parameter Syntax

$result = $client->getTemplate([
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'Template' => [
        'Arn' => '<string>',
        'ConnectorArn' => '<string>',
        'CreatedAt' => <DateTime>,
        'Definition' => [
            'TemplateV2' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'PrivateKeyAttributes' => [
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
            'TemplateV3' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                'PrivateKeyAttributes' => [
                    'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'KeyUsageProperty' => [
                        'PropertyFlags' => [
                            'Decrypt' => true || false,
                            'KeyAgreement' => true || false,
                            'Sign' => true || false,
                        ],
                        'PropertyType' => 'ALL',
                    ],
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'RequireAlternateSignatureAlgorithm' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
            'TemplateV4' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                'PrivateKeyAttributes' => [
                    'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'KeyUsageProperty' => [
                        'PropertyFlags' => [
                            'Decrypt' => true || false,
                            'KeyAgreement' => true || false,
                            'Sign' => true || false,
                        ],
                        'PropertyType' => 'ALL',
                    ],
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'RequireAlternateSignatureAlgorithm' => true || false,
                    'RequireSameKeyRenewal' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                    'UseLegacyProvider' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
        ],
        'Name' => '<string>',
        'ObjectIdentifier' => '<string>',
        'PolicySchema' => <integer>,
        'Revision' => [
            'MajorRevision' => <integer>,
            'MinorRevision' => <integer>,
        ],
        'Status' => 'ACTIVE|DELETING',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

Template

: Type: Template structure

A certificate template that the connector uses to issue certificates from a private CA.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplateGroupAccessControlEntry

$result = $client->getTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->getTemplateGroupAccessControlEntryAsync([/* ... */]);

Retrieves the group access control entries for a template.

Parameter Syntax

$result = $client->getTemplateGroupAccessControlEntry([
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

GroupSecurityIdentifier

: Required: Yes
: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'AccessControlEntry' => [
        'AccessRights' => [
            'AutoEnroll' => 'ALLOW|DENY',
            'Enroll' => 'ALLOW|DENY',
        ],
        'CreatedAt' => <DateTime>,
        'GroupDisplayName' => '<string>',
        'GroupSecurityIdentifier' => '<string>',
        'TemplateArn' => '<string>',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

AccessControlEntry

: Type: AccessControlEntry structure

An access control entry allows or denies an Active Directory group from enrolling and/or autoenrolling with a template.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListConnectors

$result = $client->listConnectors([/* ... */]);
$promise = $client->listConnectorsAsync([/* ... */]);

Lists the connectors that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateConnector action.

Parameter Syntax

$result = $client->listConnectors([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

MaxResults

: Type: int

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

: Type: string

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[
    'Connectors' => [
        [
            'Arn' => '<string>',
            'CertificateAuthorityArn' => '<string>',
            'CertificateEnrollmentPolicyServerEndpoint' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryId' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND',
            'UpdatedAt' => <DateTime>,
            'VpcInformation' => [
                'SecurityGroupIds' => ['<string>', ...],
            ],
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

Connectors

: Type: Array of ConnectorSummary structures

Summary information about each connector you have created.

NextToken

: Type: string

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListDirectoryRegistrations

$result = $client->listDirectoryRegistrations([/* ... */]);
$promise = $client->listDirectoryRegistrationsAsync([/* ... */]);

Lists the directory registrations that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateDirectoryRegistration action.

Parameter Syntax

$result = $client->listDirectoryRegistrations([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

MaxResults

: Type: int

NextToken

: Type: string

Result Syntax

[
    'DirectoryRegistrations' => [
        [
            'Arn' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryId' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

DirectoryRegistrations

: Type: Array of DirectoryRegistrationSummary structures

Summary information about each directory registration you have created.

NextToken

: Type: string

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListServicePrincipalNames

$result = $client->listServicePrincipalNames([/* ... */]);
$promise = $client->listServicePrincipalNamesAsync([/* ... */]);

Lists the service principal names that the connector uses to authenticate with Active Directory.

Parameter Syntax

$result = $client->listServicePrincipalNames([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

DirectoryRegistrationArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

MaxResults

: Type: int

NextToken

: Type: string

Result Syntax

[
    'NextToken' => '<string>',
    'ServicePrincipalNames' => [
        [
            'ConnectorArn' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryRegistrationArn' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|INTERNAL_FAILURE',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Members

NextToken

: Type: string

ServicePrincipalNames

: Type: Array of ServicePrincipalNameSummary structures

The service principal name, if any, that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Lists the tags, if any, that are associated with your resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'ResourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ResourceArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Result Syntax

[
    'Tags' => ['<string>', ...],
]

Result Details

Members

Tags

: Type: Associative array of custom strings keys (String) to strings

The tags, if any, that are associated with your resource.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplateGroupAccessControlEntries

$result = $client->listTemplateGroupAccessControlEntries([/* ... */]);
$promise = $client->listTemplateGroupAccessControlEntriesAsync([/* ... */]);

Lists group access control entries you created.

Parameter Syntax

$result = $client->listTemplateGroupAccessControlEntries([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

MaxResults

: Type: int

NextToken

: Type: string

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'AccessControlEntries' => [
        [
            'AccessRights' => [
                'AutoEnroll' => 'ALLOW|DENY',
                'Enroll' => 'ALLOW|DENY',
            ],
            'CreatedAt' => <DateTime>,
            'GroupDisplayName' => '<string>',
            'GroupSecurityIdentifier' => '<string>',
            'TemplateArn' => '<string>',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

AccessControlEntries

: Type: Array of AccessControlEntrySummary structures

An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template.

NextToken

: Type: string

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplates

$result = $client->listTemplates([/* ... */]);
$promise = $client->listTemplatesAsync([/* ... */]);

Lists the templates, if any, that are associated with a connector.

Parameter Syntax

$result = $client->listTemplates([
    'ConnectorArn' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

ConnectorArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

MaxResults

: Type: int

NextToken

: Type: string

Result Syntax

[
    'NextToken' => '<string>',
    'Templates' => [
        [
            'Arn' => '<string>',
            'ConnectorArn' => '<string>',
            'CreatedAt' => <DateTime>,
            'Definition' => [
                'TemplateV2' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'PrivateKeyAttributes' => [
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
                'TemplateV3' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                    'PrivateKeyAttributes' => [
                        'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'KeyUsageProperty' => [
                            'PropertyFlags' => [
                                'Decrypt' => true || false,
                                'KeyAgreement' => true || false,
                                'Sign' => true || false,
                            ],
                            'PropertyType' => 'ALL',
                        ],
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'RequireAlternateSignatureAlgorithm' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
                'TemplateV4' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                    'PrivateKeyAttributes' => [
                        'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'KeyUsageProperty' => [
                            'PropertyFlags' => [
                                'Decrypt' => true || false,
                                'KeyAgreement' => true || false,
                                'Sign' => true || false,
                            ],
                            'PropertyType' => 'ALL',
                        ],
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'RequireAlternateSignatureAlgorithm' => true || false,
                        'RequireSameKeyRenewal' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                        'UseLegacyProvider' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
            ],
            'Name' => '<string>',
            'ObjectIdentifier' => '<string>',
            'PolicySchema' => <integer>,
            'Revision' => [
                'MajorRevision' => <integer>,
                'MinorRevision' => <integer>,
            ],
            'Status' => 'ACTIVE|DELETING',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Members

NextToken

: Type: string

Templates

: Type: Array of TemplateSummary structures

Custom configuration templates used when issuing a certificate.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds one or more tags to your resource.

Parameter Syntax

$result = $client->tagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members

ResourceArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Tags

: Required: Yes
: Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes one or more tags from your resource.

Parameter Syntax

$result = $client->untagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'TagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members

ResourceArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

TagKeys

: Required: Yes
: Type: Array of strings

Specifies a list of tag keys that you want to remove from the specified resources.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.

UpdateTemplate

$result = $client->updateTemplate([/* ... */]);
$promise = $client->updateTemplateAsync([/* ... */]);

Update template configuration to define the information included in certificates.

Parameter Syntax

$result = $client->updateTemplate([
    'Definition' => [
        'TemplateV2' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'PrivateKeyAttributes' => [ // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV3' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [ // REQUIRED
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV4' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512',
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'RequireSameKeyRenewal' => true || false,
                'StrongKeyProtectionRequired' => true || false,
                'UseLegacyProvider' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
    ],
    'ReenrollAllCertificateHolders' => true || false,
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

Definition

: Type: TemplateDefinition structure

ReenrollAllCertificateHolders

: Type: boolean

This setting allows the major version of a template to be increased automatically. All members of Active Directory groups that are allowed to enroll with a template will receive a new certificate issued using that template.

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

UpdateTemplateGroupAccessControlEntry

$result = $client->updateTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->updateTemplateGroupAccessControlEntryAsync([/* ... */]);

Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Parameter Syntax

$result = $client->updateTemplateGroupAccessControlEntry([
    'AccessRights' => [
        'AutoEnroll' => 'ALLOW|DENY',
        'Enroll' => 'ALLOW|DENY',
    ],
    'GroupDisplayName' => '<string>',
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

AccessRights

: Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

GroupDisplayName

: Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

: Required: Yes
: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Required: Yes
: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:: You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:: An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:: The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:: The limit on the number of requests per second was exceeded.
InternalServerException:: The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:: This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Shapes

AccessControlEntry

Description

An access control entry allows or denies Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autoenrolling with the template.

Members

AccessRights

: Type: AccessRights structure

Permissions to allow or deny an Active Directory group to enroll or autoenroll certificates issued against a template.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

: Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessControlEntrySummary

Description

Summary of group access control entries that allow or deny Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autofenrolling with the template.

Members

AccessRights

: Type: AccessRights structure

Allow or deny an Active Directory group from enrolling and autoenrolling certificates issued against a template.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

: Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

: Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessDeniedException

Description

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

Members

Message

: Required: Yes
: Type: string

AccessRights

Description

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

Members

AutoEnroll

: Type: string

Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment

Enroll

: Type: string

Allow or deny an Active Directory group from enrolling certificates issued against a template.

ApplicationPolicies

Description

Application policies describe what the certificate can be used for.

Members

Critical

: Type: boolean

Marks the application policy extension as critical.

Policies

: Required: Yes
: Type: Array of ApplicationPolicy structures

Application policies describe what the certificate can be used for.

ApplicationPolicy

Description

Application policies describe what the certificate can be used for.

Members

PolicyObjectIdentifier

: Type: string

The object identifier (OID) of an application policy.

PolicyType

: Type: string

The type of application policy

CertificateValidity

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

RenewalPeriod

: Required: Yes
: Type: ValidityPeriod structure

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

ValidityPeriod

: Required: Yes
: Type: ValidityPeriod structure

ConflictException

Description

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Members

Message

: Required: Yes
: Type: string

ResourceId

: Required: Yes
: Type: string

The identifier of the Amazon Web Services resource.

ResourceType

: Required: Yes
: Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

Connector

Description

Amazon Web Services Private CA Connector for Active Directory is a service that links your Active Directory with Amazon Web Services Private CA. The connector brokers the exchange of certificates from Amazon Web Services Private CA to domain-joined users and machines managed with Active Directory.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

: Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

: Type: string

Certificate enrollment endpoint for Active Directory domain-joined objects reach out to when requesting certificates.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

: Type: string

The identifier of the Active Directory.

Status

: Type: string

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

: Type: string

Additional information about the connector status if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

: Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

ConnectorSummary

Description

Summary description of the Amazon Web Services Private CA AD connectors belonging to an Amazon Web Services account.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

: Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

: Type: string

Certificate enrollment endpoint for Active Directory domain-joined objects to request certificates.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

: Type: string

The identifier of the Active Directory.

Status

: Type: string

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

: Type: string

Additional information about the connector status if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

: Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

DirectoryRegistration

Description

The directory registration represents the authorization of the connector service with a directory.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

: Type: string

The identifier of the Active Directory.

Status

: Type: string

Status of the directory registration.

StatusReason

: Type: string

Additional information about the directory registration status if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

DirectoryRegistrationSummary

Description

The directory registration represents the authorization of the connector service with the Active Directory.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

: Type: string

The identifier of the Active Directory.

Status

: Type: string

Status of the directory registration.

StatusReason

: Type: string

Additional information about the directory registration status if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

EnrollmentFlagsV2

Description

Template configurations for v2 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

: Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

: Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

: Type: boolean

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

RemoveInvalidCertificateFromPersonalStore

: Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

: Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV3

Description

Template configurations for v3 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

: Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

: Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

: Type: boolean

RemoveInvalidCertificateFromPersonalStore

: Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

: Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV4

Description

Template configurations for v4 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

: Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

: Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

: Type: boolean

RemoveInvalidCertificateFromPersonalStore

: Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

: Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

ExtensionsV2

Description

Certificate extensions for v2 template schema

Members

ApplicationPolicies

: Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

: Required: Yes
: Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV3

Description

Certificate extensions for v3 template schema

Members

ApplicationPolicies

: Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

: Required: Yes
: Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV4

Description

Certificate extensions for v4 template schema

Members

ApplicationPolicies

: Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

: Required: Yes
: Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

GeneralFlagsV2

Description

General flags for v2 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

: Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

: Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users.

GeneralFlagsV3

Description

General flags for v3 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

: Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

: Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

GeneralFlagsV4

Description

General flags for v4 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

: Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

: Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

InternalServerException

Description

The request processing has failed because of an unknown error, exception or failure with an internal server.

Members

Message

: Required: Yes
: Type: string

KeyUsage

Description

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

Critical

: Type: boolean

Sets the key usage extension to critical.

UsageFlags

: Required: Yes
: Type: KeyUsageFlags structure

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

KeyUsageFlags

Description

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

DataEncipherment

: Type: boolean

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

DigitalSignature

: Type: boolean

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

KeyAgreement

: Type: boolean

KeyAgreement is asserted when the subject public key is used for key agreement.

KeyEncipherment

: Type: boolean

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

NonRepudiation

: Type: boolean

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

KeyUsageProperty

Description

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

Members

PropertyFlags

: Type: KeyUsagePropertyFlags structure

You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both.

PropertyType

: Type: string

You can specify all key usages using property type ALL. You can use property type or property flags but not both.

KeyUsagePropertyFlags

Description

Specifies key usage.

Members

Decrypt

: Type: boolean

Allows key for encryption and decryption.

KeyAgreement

: Type: boolean

Allows key exchange without encryption.

Sign

: Type: boolean

Allow key use for digital signature.

PrivateKeyAttributesV2

Description

Defines the attributes of the private key.

Members

CryptoProviders

: Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

: Required: Yes
: Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

MinimalKeyLength

: Required: Yes
: Type: int

Set the minimum key length of the private key.

PrivateKeyAttributesV3

Description

Defines the attributes of the private key.

Members

Algorithm

: Required: Yes
: Type: string

Defines the algorithm used to generate the private key.

CryptoProviders

: Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

: Required: Yes
: Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

: Required: Yes
: Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

: Required: Yes
: Type: int

Set the minimum key length of the private key.

PrivateKeyAttributesV4

Description

Defines the attributes of the private key.

Members

Algorithm

: Type: string

Defines the algorithm used to generate the private key.

CryptoProviders

: Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

: Required: Yes
: Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

: Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

: Required: Yes
: Type: int

Set the minimum key length of the private key.

PrivateKeyFlagsV2

Description

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

Members

ClientVersion

: Required: Yes
: Type: string

Defines the minimum client compatibility.

ExportableKey

: Type: boolean

Allows the private key to be exported.

StrongKeyProtectionRequired

: Type: boolean

Require user input when using the private key for enrollment.

PrivateKeyFlagsV3

Description

Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used.

Members

ClientVersion

: Required: Yes
: Type: string

Defines the minimum client compatibility.

ExportableKey

: Type: boolean

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

: Type: boolean

Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

StrongKeyProtectionRequired

: Type: boolean

Requirer user input when using the private key for enrollment.

PrivateKeyFlagsV4

Description

Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key.

Members

ClientVersion

: Required: Yes
: Type: string

Defines the minimum client compatibility.

ExportableKey

: Type: boolean

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

: Type: boolean

Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

RequireSameKeyRenewal

: Type: boolean

Renew certificate using the same private key.

StrongKeyProtectionRequired

: Type: boolean

Require user input when using the private key for enrollment.

UseLegacyProvider

: Type: boolean

Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers.

ResourceNotFoundException

Description

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

Members

Message

: Required: Yes
: Type: string

ResourceId

: Required: Yes
: Type: string

The identifier of the Amazon Web Services resource.

ResourceType

: Required: Yes
: Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServicePrincipalName

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.html.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Status

: Type: string

The status of a service principal name.

StatusReason

: Type: string

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was updated.

ServicePrincipalNameSummary

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Status

: Type: string

The status of a service principal name.

StatusReason

: Type: string

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

Time when the service principal name was updated.

ServiceQuotaExceededException

Description

Request would cause a service quota to be exceeded.

Members

Message

: Required: Yes
: Type: string

QuotaCode

: Required: Yes
: Type: string

The code associated with the service quota.

ResourceId

: Required: Yes
: Type: string

The identifier of the Amazon Web Services resource.

ResourceType

: Required: Yes
: Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServiceCode

: Required: Yes
: Type: string

Identifies the originating service.

SubjectNameFlagsV2

Description

Information to include in the subject name and alternate subject name of the certificate. The subject name can be common name, directory path, DNS as common name, or left blank. You can optionally include email to the subject name for user templates. If you leave the subject name blank then you must set a subject alternate name. The subject alternate name (SAN) can include globally unique identifier (GUID), DNS, domain DNS, email, service principal name (SPN), and user principal name (UPN). You can leave the SAN blank. If you leave the SAN blank, then you must set a subject name.

Members

RequireCommonName

: Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

: Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

: Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

: Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

: Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

: Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

: Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

: Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

: Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

: Type: boolean

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV3

Description

Members

RequireCommonName

: Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

: Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

: Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

: Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

: Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

: Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

: Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

: Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

: Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

: Type: boolean

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV4

Description

Members

RequireCommonName

: Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

: Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

: Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

: Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

: Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

: Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

: Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

: Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

: Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

: Type: boolean

Include the user principal name (UPN) in the subject alternate name.

Template

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

: Type: TemplateDefinition structure

Name

: Type: string

Name of the templates. Template names must be unique.

ObjectIdentifier

: Type: string

Object identifier of a template.

PolicySchema

: Type: int

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

: Type: TemplateRevision structure

The version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

: Type: string

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateDefinition

Description

Members

TemplateV2

: Type: TemplateV2 structure

TemplateV3

: Type: TemplateV3 structure

TemplateV4

: Type: TemplateV4 structure

TemplateRevision

Description

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Members

MajorRevision

: Required: Yes
: Type: int

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

MinorRevision

: Required: Yes
: Type: int

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

TemplateSummary

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

: Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

: Type: TemplateDefinition structure

Name

: Type: string

Name of the template. The template name must be unique.

ObjectIdentifier

: Type: string

Object identifier of a template.

PolicySchema

: Type: int

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

: Type: TemplateRevision structure

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

: Type: string

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

: Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateV2

Description

v2 template schema that uses Legacy Cryptographic Providers.

Members

CertificateValidity

: Required: Yes
: Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

: Required: Yes
: Type: EnrollmentFlagsV2 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

: Required: Yes
: Type: ExtensionsV2 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

: Required: Yes
: Type: GeneralFlagsV2 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

PrivateKeyAttributes

: Required: Yes
: Type: PrivateKeyAttributesV2 structure

Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers.

PrivateKeyFlags

: Required: Yes
: Type: PrivateKeyFlagsV2 structure

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

SubjectNameFlags

: Required: Yes
: Type: SubjectNameFlagsV2 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

: Type: Array of strings

List of templates in Active Directory that are superseded by this template.

TemplateV3

Description

v3 template schema that uses Key Storage Providers.

Members

CertificateValidity

: Required: Yes
: Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

: Required: Yes
: Type: EnrollmentFlagsV3 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

: Required: Yes
: Type: ExtensionsV3 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

: Required: Yes
: Type: GeneralFlagsV3 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

: Required: Yes
: Type: string

Specifies the hash algorithm used to hash the private key.

PrivateKeyAttributes

: Required: Yes
: Type: PrivateKeyAttributesV3 structure

Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers.

PrivateKeyFlags

: Required: Yes
: Type: PrivateKeyFlagsV3 structure

SubjectNameFlags

: Required: Yes
: Type: SubjectNameFlagsV3 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

: Type: Array of strings

List of templates in Active Directory that are superseded by this template.

TemplateV4

Description

v4 template schema that can use either Legacy Cryptographic Providers or Key Storage Providers.

Members

CertificateValidity

: Required: Yes
: Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

: Required: Yes
: Type: EnrollmentFlagsV4 structure

Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates.

Extensions

: Required: Yes
: Type: ExtensionsV4 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

: Required: Yes
: Type: GeneralFlagsV4 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

: Type: string

Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers.

PrivateKeyAttributes

: Required: Yes
: Type: PrivateKeyAttributesV4 structure

Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags.

PrivateKeyFlags

: Required: Yes
: Type: PrivateKeyFlagsV4 structure

SubjectNameFlags

: Required: Yes
: Type: SubjectNameFlagsV4 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

: Type: Array of strings

List of templates in Active Directory that are superseded by this template.

ThrottlingException

Description

The limit on the number of requests per second was exceeded.

Members

Message

: Required: Yes
: Type: string

QuotaCode

: Type: string

The code associated with the quota.

ServiceCode

: Type: string

Identifies the originating service.

ValidationException

Description

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

Members

Message

: Required: Yes
: Type: string

Reason

: Type: string

The reason for the validation error. This won't be return for every validation exception.

ValidityPeriod

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in hours, days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

Period

: Required: Yes
: Type: long (int|float)

The numeric value for the validity period.

PeriodType

: Required: Yes
: Type: string

The unit of time. You can select hours, days, weeks, months, and years.

VpcInformation

Description

Information about your VPC and security groups used with the connector.

Members

SecurityGroupIds

: Required: Yes
: Type: Array of strings

The security groups used with the connector. You can use a maximum of 4 security groups with a connector.

PcaConnectorAd 2018-05-10

Operation Summary

Paginators

Operations

CreateConnector

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateDirectoryRegistration

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateServicePrincipalName

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

CreateTemplate

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateTemplateGroupAccessControlEntry

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteConnector

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteDirectoryRegistration

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteServicePrincipalName

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteTemplate

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteTemplateGroupAccessControlEntry

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

GetConnector

Parameter Syntax

Parameter Details