import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Provides a resource to manage AWS Certificate Manager Private Certificate Authorities (ACM PCA Certificate Authorities). * * > **NOTE:** Creating this resource will leave the certificate authority in a `PENDING_CERTIFICATE` status, which means it cannot yet issue certificates. To complete this setup, you must fully sign the certificate authority CSR available in the `certificateSigningRequest` attribute. The `aws.acmpca.CertificateAuthorityCertificate` resource can be used for this purpose. * * ## Example Usage * * ### Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as aws from "@pulumi/aws"; * * const example = new aws.acmpca.CertificateAuthority("example", { * certificateAuthorityConfiguration: { * keyAlgorithm: "RSA_4096", * signingAlgorithm: "SHA512WITHRSA", * subject: { * commonName: "example.com", * }, * }, * permanentDeletionTimeInDays: 7, * }); * ``` * * ### Short-lived certificate * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as aws from "@pulumi/aws"; * * const example = new aws.acmpca.CertificateAuthority("example", { * usageMode: "SHORT_LIVED_CERTIFICATE", * certificateAuthorityConfiguration: { * keyAlgorithm: "RSA_4096", * signingAlgorithm: "SHA512WITHRSA", * subject: { * commonName: "example.com", * }, * }, * }); * ``` * * ### Enable Certificate Revocation List * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as aws from "@pulumi/aws"; * * const example = new aws.s3.Bucket("example", { * bucket: "example", * forceDestroy: true, * }); * const acmpcaBucketAccess = aws.iam.getPolicyDocumentOutput({ * statements: [{ * actions: [ * "s3:GetBucketAcl", * "s3:GetBucketLocation", * "s3:PutObject", * "s3:PutObjectAcl", * ], * resources: [ * example.arn, * pulumi.interpolate`${example.arn}/*`, * ], * principals: [{ * identifiers: ["acm-pca.amazonaws.com"], * type: "Service", * }], * }], * }); * const exampleBucketPolicy = new aws.s3.BucketPolicy("example", { * bucket: example.id, * policy: acmpcaBucketAccess.apply(acmpcaBucketAccess => acmpcaBucketAccess.json), * }); * const exampleCertificateAuthority = new aws.acmpca.CertificateAuthority("example", { * certificateAuthorityConfiguration: { * keyAlgorithm: "RSA_4096", * signingAlgorithm: "SHA512WITHRSA", * subject: { * commonName: "example.com", * }, * }, * revocationConfiguration: { * crlConfiguration: { * customCname: "crl.example.com", * enabled: true, * expirationInDays: 7, * s3BucketName: example.id, * s3ObjectAcl: "BUCKET_OWNER_FULL_CONTROL", * }, * }, * }, { * dependsOn: [exampleBucketPolicy], * }); * ``` * * ## Import * * ### Identity Schema * * #### Required * * - `arn` (String) Amazon Resource Name (ARN) of the ACM PCA certificate authority. * * Using `pulumi import`, import `aws_acmpca_certificate_authority` using the certificate authority ARN. For example: * * % pulumi import aws_acmpca_certificate_authority.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012 */ export declare class CertificateAuthority extends pulumi.CustomResource { /** * Get an existing CertificateAuthority resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: CertificateAuthorityState, opts?: pulumi.CustomResourceOptions): CertificateAuthority; /** * Returns true if the given object is an instance of CertificateAuthority. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is CertificateAuthority; /** * ARN of the certificate authority. */ readonly arn: pulumi.Output; /** * Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported. */ readonly certificate: pulumi.Output; /** * Nested argument containing algorithms and certificate subject information. Defined below. */ readonly certificateAuthorityConfiguration: pulumi.Output; /** * Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported. */ readonly certificateChain: pulumi.Output; /** * The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate. */ readonly certificateSigningRequest: pulumi.Output; /** * Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `ACTIVE` state. */ readonly enabled: pulumi.Output; /** * Cryptographic key management compliance standard used for handling CA keys. Defaults to `FIPS_140_2_LEVEL_3_OR_HIGHER`. Valid values: `FIPS_140_2_LEVEL_3_OR_HIGHER` and `FIPS_140_2_LEVEL_2_OR_HIGHER`. Supported standard for each region can be found in the [Storage and security compliance of AWS Private CA private keys Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys). */ readonly keyStorageSecurityStandard: pulumi.Output; /** * Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported. */ readonly notAfter: pulumi.Output; /** * Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported. */ readonly notBefore: pulumi.Output; /** * Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days. */ readonly permanentDeletionTimeInDays: pulumi.Output; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ readonly region: pulumi.Output; /** * Nested argument containing revocation configuration. Defined below. */ readonly revocationConfiguration: pulumi.Output; /** * Serial number of the certificate authority. Only available after the certificate authority certificate has been imported. */ readonly serial: pulumi.Output; /** * Key-value map of user-defined tags that are attached to the certificate authority. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. */ readonly tags: pulumi.Output<{ [key: string]: string; } | undefined>; /** * Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. */ readonly tagsAll: pulumi.Output<{ [key: string]: string; }>; /** * Type of the certificate authority. Defaults to `SUBORDINATE`. Valid values: `ROOT` and `SUBORDINATE`. */ readonly type: pulumi.Output; /** * Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults to `GENERAL_PURPOSE`. Valid values: `GENERAL_PURPOSE` and `SHORT_LIVED_CERTIFICATE`. */ readonly usageMode: pulumi.Output; /** * Create a CertificateAuthority resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: CertificateAuthorityArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering CertificateAuthority resources. */ export interface CertificateAuthorityState { /** * ARN of the certificate authority. */ arn?: pulumi.Input; /** * Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported. */ certificate?: pulumi.Input; /** * Nested argument containing algorithms and certificate subject information. Defined below. */ certificateAuthorityConfiguration?: pulumi.Input; /** * Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported. */ certificateChain?: pulumi.Input; /** * The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate. */ certificateSigningRequest?: pulumi.Input; /** * Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `ACTIVE` state. */ enabled?: pulumi.Input; /** * Cryptographic key management compliance standard used for handling CA keys. Defaults to `FIPS_140_2_LEVEL_3_OR_HIGHER`. Valid values: `FIPS_140_2_LEVEL_3_OR_HIGHER` and `FIPS_140_2_LEVEL_2_OR_HIGHER`. Supported standard for each region can be found in the [Storage and security compliance of AWS Private CA private keys Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys). */ keyStorageSecurityStandard?: pulumi.Input; /** * Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported. */ notAfter?: pulumi.Input; /** * Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported. */ notBefore?: pulumi.Input; /** * Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days. */ permanentDeletionTimeInDays?: pulumi.Input; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ region?: pulumi.Input; /** * Nested argument containing revocation configuration. Defined below. */ revocationConfiguration?: pulumi.Input; /** * Serial number of the certificate authority. Only available after the certificate authority certificate has been imported. */ serial?: pulumi.Input; /** * Key-value map of user-defined tags that are attached to the certificate authority. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. */ tags?: pulumi.Input<{ [key: string]: pulumi.Input; }>; /** * Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. */ tagsAll?: pulumi.Input<{ [key: string]: pulumi.Input; }>; /** * Type of the certificate authority. Defaults to `SUBORDINATE`. Valid values: `ROOT` and `SUBORDINATE`. */ type?: pulumi.Input; /** * Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults to `GENERAL_PURPOSE`. Valid values: `GENERAL_PURPOSE` and `SHORT_LIVED_CERTIFICATE`. */ usageMode?: pulumi.Input; } /** * The set of arguments for constructing a CertificateAuthority resource. */ export interface CertificateAuthorityArgs { /** * Nested argument containing algorithms and certificate subject information. Defined below. */ certificateAuthorityConfiguration: pulumi.Input; /** * Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `ACTIVE` state. */ enabled?: pulumi.Input; /** * Cryptographic key management compliance standard used for handling CA keys. Defaults to `FIPS_140_2_LEVEL_3_OR_HIGHER`. Valid values: `FIPS_140_2_LEVEL_3_OR_HIGHER` and `FIPS_140_2_LEVEL_2_OR_HIGHER`. Supported standard for each region can be found in the [Storage and security compliance of AWS Private CA private keys Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys). */ keyStorageSecurityStandard?: pulumi.Input; /** * Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days. */ permanentDeletionTimeInDays?: pulumi.Input; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ region?: pulumi.Input; /** * Nested argument containing revocation configuration. Defined below. */ revocationConfiguration?: pulumi.Input; /** * Key-value map of user-defined tags that are attached to the certificate authority. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. */ tags?: pulumi.Input<{ [key: string]: pulumi.Input; }>; /** * Type of the certificate authority. Defaults to `SUBORDINATE`. Valid values: `ROOT` and `SUBORDINATE`. */ type?: pulumi.Input; /** * Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults to `GENERAL_PURPOSE`. Valid values: `GENERAL_PURPOSE` and `SHORT_LIVED_CERTIFICATE`. */ usageMode?: pulumi.Input; }