Under properties, configure the following AWS CA-specific settings.
aws-api-url
The AWS CA API regional URL for the plugin to interact with AWS. For example:
"https://acm-pca.us-east-1.amazonaws.com:443/"Mandatory: Yes.
aws-assume-role-arn
The AWS ARN that uniquely identifies the IAM role. This is used when your AWS user configured above does not have the required permission under the AWS user. If this parameter is defined, the plugin will assume the AWS IAM role defined and obtain temporary security credentials in order to access the AWS resources needed.
Your AWS user should have a role with permissions for the required resources such as dynamodb access, awscm private ca access, S3 CRL, and audit report access.
Mandatory: No.
aws-ca-arn
The AWS ARN that uniquely identifies the AWS CA. For example:
"arn:aws:acm-pca:us-east-1:422825380052:certificate-authority/b6fd6660-e6eb-4fed-9fe9-d5a82f952ed4"Mandatory: Yes.
aws-ca-audit-report-s3-bucket-name
The AWS S3 bucket name uniquely identifying the bucket for saving AWS Audit Reports. For example:
"cagw-audit-report"You can generate multiple Audit Reports in a shared bucket. Each generated report in the bucket will be an object with a unique key.
Mandatory: No.
aws-ca-s3-crl-arn
The AWS ARN uniquely identifying the bucket for saving the CRL. For example:
"arn:aws:s3:::wy-crl"Mandatory: Yes.
aws-region
The AWS region of the CA. For example:
"us-east-1"CA instances are only available in their region.
Mandatory: Yes.
aws-sts-token-duration-in-seconds
The duration in seconds that the STS temporary credential should remain valid. Default is 1200 seconds if not specified.
Mandatory: When defined together with properties.aws-ca-cert-template-arn in the AWS CA profile settings.
aws-user-access-key-id
The AWS API username. For example:
"AKIAWE4S3JDKMNSG5K5T"Mandatory: Yes.
aws-user-arn
The AWS ARN that uniquely identifies the IAM user
Mandatory: Yes.
aws-user-login-url
The AWS sign URL for the IAM user
Mandatory: Yes.
aws-user-secret-access-key
The AWS API password.
Mandatory: Yes.
certificate-events-storage-method
The storage type for recording events – for example:
“DynamoDb”Mandatory: No
dynamodb-table-name
The name of the Dynamo database for storing the events.
Mandatory: When the value of certificate-events-storage-method is "Dynamo DB".