Resource-based policies - AWS Private Certificate Authority
Policy examples

Resource-based policies

Resource-based policies are permissions policies that you create and manually attach to a resource (in this case, a private CA) rather than to a user identity or role. Or, instead of creating your own policies, you can use AWS managed policies for AWS Private CA. Using AWS RAM to apply a resource-based policy, an AWS Private CA administrator can share access to a CA with a user in a different AWS account directly or through AWS Organizations. Alternatively, an AWS Private CA administrator can use the PCA APIs PutPolicy, GetPolicy, and DeletePolicy, or the corresponding AWS CLI commands put-policy, get-policy, and delete-policy, to apply and manage resource-based policies.

For general information about resource-based policies, see Identity-Based Policies and Resource-Based Policies and Controlling Access Using Policies.

To view the list of AWS managed resource-based policies for AWS Private CA, navigate to the Managed permissions library in the AWS Resource Access Manager console, and search for CertificateAuthority. As with any policy, before you apply it, we recommend applying the policy in a test environment to ensure that it meets your requirements.

AWS Certificate Manager (ACM) users with cross-account shared access to a private CA can issue managed certificates that are signed by the CA. Cross-account issuers are constrained by a resource-based policy and have access only to the following end-entity certificate templates:

Policy examples

This section provides example cross-account policies for various needs. In all cases, the following command pattern is used to apply a policy:

$ aws acm-pca put-policy \
   --region region \
   --resource-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566 \
   --policy file:///[path]/policyN.json

In addition to specifying the ARN of a CA, the administrator provides an AWS account ID or an AWS Organizations ID that will be granted access to the CA. The JSON of each of the following polices is formatted as a file for readability, but can also be supplied as an inline CLI arguments.

Note

The structure of the JSON resource-based polices shown below must be followed precisely. Only the ID fields for the principals (the AWS account number or the AWS Organizations ID) and the CA ARNs can be configured by customers.

  1. File: policy1.json – Sharing access to a CA with a user in a different account

    Replace 555555555555 with the AWS account ID that's sharing the CA.

    For the resource ARN, replace the following with your own values:

    • aws - The AWS partition. For example, aws, aws-us-gov, aws-cn, etc.

    • us-east-1 - The AWS Region that the resource is available in, such as us-west-1.

    • 111122223333 - The AWS account ID of the resource owner.

    • 11223344-1234-1122-2233-112233445566 - The resource ID of the certificate authority.

     {                        
   "Version":"2012-10-17",
   "Statement":[
      {    
         "Sid":"ExampleStatementID",
         "Effect":"Allow",         
         "Principal":{                                                                                                                                               
            "AWS":"555555555555"                                                                                
         },
         "Action":[
            "acm-pca:DescribeCertificateAuthority",
            "acm-pca:GetCertificate",
            "acm-pca:GetCertificateAuthorityCertificate",
            "acm-pca:ListPermissions",
            "acm-pca:ListTags"                                                                                   
         ],                                                                                              
         "Resource":"arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566"
      },
      {
         "Sid":"ExampleStatementID2",  
         "Effect":"Allow",
         "Principal":{
            "AWS":"555555555555"
         },
         "Action":[
            "acm-pca:IssueCertificate"
         ],
         "Resource":"arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
         "Condition":{
            "StringEquals":{
               "acm-pca:TemplateArn":"arn:aws:acm-pca:::template/EndEntityCertificate/V1"
            }
         }
      }
   ]
}

  2. File: policy2.json – Sharing access to a CA through AWS Organizations

    Replace o-a1b2c3d4z5 with the AWS Organizations ID.

    For the resource ARN, replace the following with your own values:

    • aws - The AWS partition. For example, aws, aws-us-gov, aws-cn, etc.

    • us-east-1 - The AWS Region that the resource is available in, such as us-west-1.

    • 111122223333 - The AWS account ID of the resource owner.

    • 11223344-1234-1122-2233-112233445566 - The resource ID of the certificate authority.

    {
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"ExampleStatementID3",
         "Effect":"Allow",
         "Principal":"*",
         "Action":"acm-pca:IssueCertificate",
         "Resource":"arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
         "Condition":{
            "StringEquals":{
               "acm-pca:TemplateArn":"arn:aws:acm-pca:::template/EndEntityCertificate/V1",
               "aws:PrincipalOrgID":"o-a1b2c3d4z5"
            },
            "StringNotEquals":{
               "aws:PrincipalAccount":"111122223333"
            }
         }
      },
      {
         "Sid":"ExampleStatementID4",
         "Effect":"Allow",
         "Principal":"*",
         "Action":[
            "acm-pca:DescribeCertificateAuthority",
            "acm-pca:GetCertificate",
            "acm-pca:GetCertificateAuthorityCertificate",
            "acm-pca:ListPermissions",
            "acm-pca:ListTags"
         ],
         "Resource":"arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
         "Condition":{
            "StringEquals":{
               "aws:PrincipalOrgID":"o-a1b2c3d4z5"
            },
            "StringNotEquals":{
               "aws:PrincipalAccount":"111122223333"
         }
      }
   ]
}