acmpca

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 14, 2026 License: MIT Imports: 35 Imported by: 0

README

ACM PCA

Parity grade: A · SDK aws-sdk-go-v2/service/acmpca@v1.50.0 · last audited 2026-09-11 (3cec3729)

Coverage

Metric Value
PARITY entries audited 23 (23 ok)
Known gaps 7
Deferred items 0
Resource leaks clean
Known gaps
  • NEW (found this pass): CertificateAuthority.FailureReason (types.FailureReason: REQUEST_TIMED_OUT/UNSUPPORTED_ALGORITHM/OTHER) and CertificateAuthorityStatus's FAILED/EXPIRED enum values are entirely unmodeled -- CreateCertificateAuthority is synchronous and always succeeds or returns an immediate validation error, so no CA ever reaches FAILED, and no expiry-driven ACTIVE->EXPIRED transition is simulated. FailureReason is correctly never emitted (matching the real API omitting it whenever Status != FAILED), so this is a state-machine depth gap, not a wire-shape bug -- disclosed, not fixed (would need a new terminal status + expiry sweep, out of scope for a wrapper-key/nesting sweep).
  • NEW (found this pass): CertificateAuthorityConfiguration.CsrExtensions (nested CsrExtensions{KeyUsage, SubjectInformationAccess->AccessDescription{AccessMethod,GeneralName}}) is accepted by neither CreateCertificateAuthority's input decoding (caConfigInput has no CsrExtensions field) nor echoed by Describe/List -- silently dropped on the request side rather than rejected. Real AWS would echo a caller-supplied CsrExtensions back on every subsequent Describe/List; gopherstack never stores it, so a caller setting it gets no error but also never sees it round-trip. Disclosed, not fixed -- same class of gap as the already-documented ASN1Subject exotic RDN types, but this one lacks the explicit-rejection treatment those get in decodeASN1Subject/decodeExtensions (handler_certificates.go); a caller has no signal the field was ignored.
  • IssueCertificate's END_DATE validity type is still treated as Unix epoch seconds (same as ABSOLUTE) rather than true UTCTime/GeneralizedTime -- pre-existing intentional simplification, not touched this pass (see Traps)
  • gopherstack-cq4o residual: TemplateArn's CSRPassthrough/APICSRPassthrough varieties only honor Subject/DNSNames already parsed from the CSR by crypto/x509 (the pre-existing behavior); a CSR's own embedded X.509 extensions (e.g. a requested KeyUsage/ExtendedKeyUsage/SAN via a PKCS#10 extensionRequest attribute) are not separately extracted and passed through for Blank*_CSRPassthrough templates -- only ApiPassthrough-sourced KeyUsage/ExtendedKeyUsage/SAN are honored for those. Narrower than a full CSR-extension-passthrough implementation; the documented per-family fixed-extension profiles (the bulk of TemplateArn's behavior) are otherwise fully implemented.
  • gopherstack-cq4o residual: the per-template CRL-distribution-point sourcing nuance ('[Passthrough from CA configuration or CSR]' on *CSRPassthrough/*APICSRPassthrough template families) is not modeled -- gopherstack always sources the CRL distribution point from the CA's own RevocationConfiguration regardless of template passthrough kind (matching the non-CSRPassthrough families exactly); a CSR-embedded CRL distribution point extension is never parsed or honored.
  • gopherstack-cq4o residual: TemplateArn's CA-hierarchy path-length inheritance rule ('The CA depth configured on a subordinate CA certificate must not exceed the limit set by its parents in the CA hierarchy') is not enforced -- SubordinateCACertificate_PathLenN's fixed pathLenConstraint is applied to the issued certificate correctly, but no cross-check against the issuing CA's own position in a CA hierarchy is performed (this backend does not model CA hierarchies/parent-child relationships at all).
  • DELETED CAs past their RestorableUntil deadline are hidden from every read path (Describe/List/Get/Issue/etc. all treat them as not-found, matching real AWS's user-visible behavior) and RestoreCertificateAuthority correctly rejects them, but the row is not physically freed from the in-memory store.Table until the next process Reset() -- consistent with how every other terminal-state resource in this backend (revoked certs, etc.) is retained rather than garbage-collected; not a new leak, just not a true memory-reclaiming sweep

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrCANotFound is returned when a Certificate Authority is not found.
	ErrCANotFound = errors.New("ResourceNotFoundException")
	// ErrCertNotFound is returned when an issued certificate is not found.
	ErrCertNotFound = errors.New("ResourceNotFoundException")
	// ErrInvalidArgs is returned when an operation argument fails validation.
	// acm-pca's own deserializeOpError models InvalidArgsException, not the
	// fabricated InvalidParameterException gopherstack previously emitted
	// (gopherstack-r3pr): see aws-sdk-go-v2/service/acmpca deserializers.go,
	// e.g. awsAwsjson11_deserializeOpErrorCreateCertificateAuthority.
	ErrInvalidArgs = errors.New("InvalidArgsException")
	// ErrInvalidArn is returned when a CA/certificate/resource ARN fails
	// validation or lookup, matching InvalidArnException (modeled by nearly
	// every acm-pca operation's deserializeOpError).
	ErrInvalidArn = errors.New("InvalidArnException")
	// ErrInvalidRequest is returned when the request action cannot be
	// performed or is prohibited, matching InvalidRequestException
	// (RevokeCertificate, ImportCertificateAuthorityCertificate).
	ErrInvalidRequest = errors.New("InvalidRequestException")
	// ErrInvalidPolicy is returned when a resource policy is invalid or
	// missing a required statement, matching InvalidPolicyException
	// (PutPolicy).
	ErrInvalidPolicy = errors.New("InvalidPolicyException")
	// ErrMalformedCertificate is returned when an imported certificate fails
	// to decode/parse, matching MalformedCertificateException
	// (ImportCertificateAuthorityCertificate).
	ErrMalformedCertificate = errors.New("MalformedCertificateException")
	// ErrMalformedCSR is returned when a certificate signing request fails
	// to decode/parse, matching MalformedCSRException (IssueCertificate).
	ErrMalformedCSR = errors.New("MalformedCSRException")
	// ErrInvalidState is returned when the CA is in an invalid state for the operation.
	ErrInvalidState = errors.New("InvalidStateException")
	// ErrPermissionNotFound is returned when a CA permission is not found.
	ErrPermissionNotFound = errors.New("ResourceNotFoundException")
	// ErrPermissionAlreadyExists is returned when a permission for the same
	// principal/source-account pair already exists on the CA.
	ErrPermissionAlreadyExists = errors.New("PermissionAlreadyExistsException")
	// ErrPolicyNotFound is returned when a CA policy is not found.
	ErrPolicyNotFound = errors.New("ResourceNotFoundException")
	// ErrAuditReportNotFound is returned when a CA audit report is not found.
	ErrAuditReportNotFound = errors.New("ResourceNotFoundException")
	// ErrTooManyTags is returned when tagging a CA would exceed the 50-tag limit.
	ErrTooManyTags = errors.New("TooManyTagsException")
	// ErrRequestAlreadyProcessed is returned when RevokeCertificate is called
	// on a certificate that is already revoked, matching
	// RequestAlreadyProcessedException ("Your request has already been
	// completed") -- modeled only by RevokeCertificate's own deserializeOpError
	// (acmpca@v1.50.0 deserializers.go), not by any other operation in this
	// service.
	ErrRequestAlreadyProcessed = errors.New("RequestAlreadyProcessedException")
)

Functions

This section is empty.

Types

type APIPassthrough added in v1.2.0 

type APIPassthrough struct {
	Subject    *APIPassthroughSubject
	Extensions *APIPassthroughExtensions
}

APIPassthrough mirrors aws-sdk-go-v2 types.APIPassthrough: the subject and X.509 extension overrides IssueCertificate applies when the request's TemplateArn selects an APIPassthrough/APICSRPassthrough template variant (see decodeAPIPassthrough in handler_certificates.go for that gating).

type APIPassthroughCustomAttribute 

type APIPassthroughCustomAttribute struct {
	ObjectIdentifier string
	Value            string
}

APIPassthroughCustomAttribute mirrors aws-sdk-go-v2 types.CustomAttribute: an arbitrary X.500 relative distinguished name identified by OID.

type APIPassthroughCustomExtension added in v1.2.0 

type APIPassthroughCustomExtension struct {
	ObjectIdentifier string
	ValueBase64      string
	Critical         bool
}

APIPassthroughCustomExtension mirrors aws-sdk-go-v2 types.CustomExtension: an arbitrary X.509 extension identified by OID, carrying an already-DER-encoded value the caller supplies verbatim (base64 on the wire).

type APIPassthroughEdiPartyName 

type APIPassthroughEdiPartyName struct {
	PartyName    string
	NameAssigner string
}

APIPassthroughEdiPartyName mirrors aws-sdk-go-v2 types.EdiPartyName (EDIPartyName ::= SEQUENCE { nameAssigner [0] DirectoryString OPTIONAL, partyName [1] DirectoryString }, RFC 5280 §4.2.1.6). Both fields are EXPLICITly tagged: DirectoryString is itself a CHOICE, and X.680 forbids IMPLICIT tagging of a CHOICE type even under this module's default IMPLICIT tagging environment.

type APIPassthroughExtendedKeyUsage added in v1.2.0 

type APIPassthroughExtendedKeyUsage struct {
	Type             string
	ObjectIdentifier string
}

APIPassthroughExtendedKeyUsage mirrors aws-sdk-go-v2 types.ExtendedKeyUsage: exactly one of Type (a standard ExtendedKeyUsageType) or ObjectIdentifier (a custom OID) is set.

type APIPassthroughExtensions added in v1.2.0 

type APIPassthroughExtensions struct {
	KeyUsage                *APIPassthroughKeyUsage
	CertificatePolicies     []APIPassthroughPolicyInformation
	ExtendedKeyUsage        []APIPassthroughExtendedKeyUsage
	SubjectAlternativeNames []APIPassthroughSAN
	CustomExtensions        []APIPassthroughCustomExtension
}

APIPassthroughExtensions mirrors aws-sdk-go-v2 types.Extensions.

type APIPassthroughKeyUsage added in v1.2.0 

type APIPassthroughKeyUsage struct {
	DigitalSignature bool
	NonRepudiation   bool
	KeyEncipherment  bool
	DataEncipherment bool
	KeyAgreement     bool
	KeyCertSign      bool
	CRLSign          bool
	EncipherOnly     bool
	DecipherOnly     bool
}

APIPassthroughKeyUsage mirrors aws-sdk-go-v2 types.KeyUsage.

type APIPassthroughOtherName 

type APIPassthroughOtherName struct {
	TypeID string
	Value  string
}

APIPassthroughOtherName mirrors aws-sdk-go-v2 types.OtherName: an arbitrary-OID GeneralName variant (OtherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY DEFINED BY type-id }, RFC 5280 §4.2.1.6). Neither the SDK doc comment nor RFC 5280 fixes an ASN.1 type for the type-id-defined value; gopherstack encodes it as a UTF8String -- a design choice, not a verified SDK/RFC fact.

type APIPassthroughPolicyInformation 

type APIPassthroughPolicyInformation struct {
	CertPolicyID string
	Qualifiers   []APIPassthroughPolicyQualifier
}

APIPassthroughPolicyInformation mirrors aws-sdk-go-v2 types.PolicyInformation: the X.509 certificatePolicies extension (RFC 5280 §4.2.1.4, OID 2.5.29.32).

type APIPassthroughPolicyQualifier 

type APIPassthroughPolicyQualifier struct {
	CPSURI string
}

APIPassthroughPolicyQualifier mirrors aws-sdk-go-v2 types.Qualifier. Amazon Web Services Private CA supports only the certification practice statement (CPS) qualifier -- types.PolicyQualifierId's only enum value is "CPS" (verified via acmpca/types/enums.go).

type APIPassthroughSAN added in v1.2.0 

type APIPassthroughSAN struct {
	OtherName                 *APIPassthroughOtherName
	DirectoryName             *APIPassthroughSubject
	EdiPartyName              *APIPassthroughEdiPartyName
	DNSName                   string
	IPAddress                 string
	EmailAddress              string
	UniformResourceIdentifier string
	RegisteredID              string
}

APIPassthroughSAN mirrors aws-sdk-go-v2 types.GeneralName: exactly one field is set per RFC 5280's GeneralName CHOICE (enforced by decodeGeneralName in handler_certificates.go, which also enforces the SDK's documented "Providing more than one option results in an InvalidArgsException" rule). DnsName/IpAddress/Rfc822Name/ UniformResourceIdentifier map directly to x509.Certificate's standard SAN fields when no exotic variant is present in the same request; OtherName, DirectoryName, EdiPartyName, and RegisteredId require a hand-built subjectAltName extension -- see applySubjectAlternativeNames in crypto.go.

type APIPassthroughSubject added in v1.2.0 

type APIPassthroughSubject struct {
	CommonName                 string
	Country                    string
	Organization               string
	OrganizationalUnit         string
	State                      string
	Locality                   string
	SerialNumber               string
	DistinguishedNameQualifier string
	GenerationQualifier        string
	GivenName                  string
	Initials                   string
	Pseudonym                  string
	Surname                    string
	Title                      string
	CustomAttributes           []APIPassthroughCustomAttribute
}

APIPassthroughSubject overrides the CSR-derived certificate subject with explicit X.500 attributes, mirroring every field of aws-sdk-go-v2 types.ASN1Subject. The exotic RDN types (DistinguishedNameQualifier, GenerationQualifier, GivenName, Initials, Pseudonym, Surname, Title, CustomAttributes) are carried through pkix.Name.ExtraNames -- see apiPassthroughSubjectToPKIX in crypto.go -- using the RFC 5280 Appendix A.1 / RFC 4519 OIDs (pseudonym 2.5.4.65, generationQualifier 2.5.4.44, dnQualifier 2.5.4.46, title 2.5.4.12, initials 2.5.4.43, givenName 2.5.4.42, surname 2.5.4.4).

type AuditReport 

type AuditReport struct {
	CreatedAt               time.Time `json:"createdAt"`
	AuditReportID           string    `json:"auditReportId"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	S3BucketName            string    `json:"s3BucketName"`
	S3Key                   string    `json:"s3Key"`
	Status                  string    `json:"status"`
	// contains filtered or unexported fields
}

AuditReport represents an ACM PCA audit report generated for a certificate authority.

type CertificateAuthority 

type CertificateAuthority struct {
	CreatedAt time.Time `json:"createdAt"`
	NotBefore time.Time `json:"notBefore"`
	NotAfter  time.Time `json:"notAfter"`
	// RestorableUntil is the end of the restoration window while the CA is
	// DELETED (see DeleteCertificateAuthority); zero once the CA is not DELETED.
	RestorableUntil time.Time `json:"restorableUntil"`
	// LastStateChangeAt is updated on every operation that changes Status or
	// the CA's certificate material (Create, Import, self-sign-activate,
	// Update, Delete, Restore), mirroring types.CertificateAuthority's
	// LastStateChangeAt field.
	LastStateChangeAt time.Time `json:"lastStateChangeAt"`

	CertificateAuthorityConfiguration CertificateAuthorityConfiguration `json:"certificateAuthorityConfiguration"`
	// RevocationConfiguration holds the CRL/OCSP settings accepted by
	// CreateCertificateAuthority/UpdateCertificateAuthority; nil means "not
	// configured" (DescribeCertificateAuthority omits the field entirely, as
	// the real SDK does for a nil *types.RevocationConfiguration).
	RevocationConfiguration *RevocationConfiguration `json:"revocationConfiguration,omitempty"`
	ARN                     string                   `json:"arn"`
	OwnerAccount            string                   `json:"ownerAccount"`
	Type                    string                   `json:"type"`
	Status                  string                   `json:"status"`
	// KeyStorageSecurityStandard mirrors types.KeyStorageSecurityStandard;
	// defaults to FIPS_140_2_LEVEL_3_OR_HIGHER, matching the real API's default.
	KeyStorageSecurityStandard string `json:"keyStorageSecurityStandard,omitempty"`
	// UsageMode mirrors types.CertificateAuthorityUsageMode; defaults to
	// GENERAL_PURPOSE. When SHORT_LIVED_CERTIFICATE, IssueCertificate enforces
	// the real API's 7-day validity cap for certificates issued by this CA.
	UsageMode        string `json:"usageMode,omitempty"`
	Serial           string `json:"serial,omitempty"`
	CertificateBody  string `json:"certificateBody,omitempty"`
	CertificateChain string `json:"certificateChain,omitempty"`
	CSR              string `json:"csr,omitempty"`
	// contains filtered or unexported fields
}

CertificateAuthority represents an ACM PCA Certificate Authority.

type CertificateAuthorityConfiguration 

type CertificateAuthorityConfiguration struct {
	Subject          CertificateAuthoritySubject `json:"Subject"`
	KeyAlgorithm     string                      `json:"KeyAlgorithm"`
	SigningAlgorithm string                      `json:"SigningAlgorithm"`
}

CertificateAuthorityConfiguration holds the configuration for a Certificate Authority.

type CertificateAuthoritySubject 

type CertificateAuthoritySubject struct {
	CommonName         string `json:"CommonName,omitempty"`
	Country            string `json:"Country,omitempty"`
	Organization       string `json:"Organization,omitempty"`
	OrganizationalUnit string `json:"OrganizationalUnit,omitempty"`
	State              string `json:"State,omitempty"`
	Locality           string `json:"Locality,omitempty"`
}

CertificateAuthoritySubject holds the subject fields for a Certificate Authority.

type CreateCAOption added in v1.2.0 

type CreateCAOption func(*createCAOptions)

CreateCAOption customizes CreateCertificateAuthority. See WithCreateCA* below.

func WithCreateCAIdempotencyToken added in v1.2.0 

func WithCreateCAIdempotencyToken(token string) CreateCAOption

WithCreateCAIdempotencyToken deduplicates repeated CreateCertificateAuthority calls bearing the same token within a 5-minute window: the original CA's ARN is returned instead of creating a duplicate.

func WithCreateCAKeyStorageSecurityStandard added in v1.2.0 

func WithCreateCAKeyStorageSecurityStandard(std string) CreateCAOption

WithCreateCAKeyStorageSecurityStandard sets KeyStorageSecurityStandard.

func WithCreateCARevocationConfiguration added in v1.2.0 

func WithCreateCARevocationConfiguration(rc *RevocationConfiguration) CreateCAOption

WithCreateCARevocationConfiguration sets the CA's initial CRL/OCSP configuration.

func WithCreateCAUsageMode added in v1.2.0 

func WithCreateCAUsageMode(mode string) CreateCAOption

WithCreateCAUsageMode sets UsageMode (GENERAL_PURPOSE or SHORT_LIVED_CERTIFICATE).

type CrlConfiguration added in v1.2.0 

type CrlConfiguration struct {
	CustomCname      string `json:"customCname,omitempty"`
	CustomPath       string `json:"customPath,omitempty"`
	S3BucketName     string `json:"s3BucketName,omitempty"`
	S3ObjectACL      string `json:"s3ObjectAcl,omitempty"`
	CrlType          string `json:"crlType,omitempty"`
	ExpirationInDays int32  `json:"expirationInDays,omitempty"`
	Enabled          bool   `json:"enabled"`
	OmitExtension    bool   `json:"omitExtension,omitempty"`
}

CrlConfiguration mirrors aws-sdk-go-v2 types.CrlConfiguration: certificate revocation list settings for a CA. CrlDistributionPointExtensionConfiguration is flattened into OmitExtension (its only field).

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM PCA operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM PCA handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM PCA instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM PCA action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the primary ARN from the JSON body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported ACM PCA operations.

func (*Handler) GetTagsForTest 

func (h *Handler) GetTagsForTest(resourceID string) []map[string]string

GetTagsForTest is a test helper that returns all tags for a resource by ARN.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM PCA JSON-protocol requests.

func (*Handler) SetTagsForTest 

func (h *Handler) SetTagsForTest(resourceID string, kv map[string]string)

SetTagsForTest is a test helper that sets tags for a resource by ARN.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM PCA resources.

The CA/certificate/permission/audit-report collections below were previously nested by region (outer key = region, e.g. map[string]map[string]*CertificateAuthority) so that same-ARN-shaped resources in different regions were fully isolated. Phase 3.3 of the datalayer refactor replaces each of those with a flat *store.Table, keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping certs/permissions by (region, CA ARN) for the CA-scoped list operations -- the same region-qualified-table pattern services/emr/services/neptune/services/mwaa use. certsByCASerial (a derived, rebuilt-on-Restore lookup of bare strings with no identity of their own) and policies (a bare string value with no identity struct) are deliberately NOT converted to store.Table: store.Table requires a *V value with its own identity, which neither has; they remain plain region-nested maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) CreateCertificateAuthority 

func (b *InMemoryBackend) CreateCertificateAuthority(
	ctx context.Context,
	caType string,
	cfg CertificateAuthorityConfiguration,
	opts ...CreateCAOption,
) (*CertificateAuthority, error)

CreateCertificateAuthority creates a new Certificate Authority.

func (*InMemoryBackend) CreateCertificateAuthorityAuditReport 

func (b *InMemoryBackend) CreateCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	s3BucketName string,
	responseFormat string,
) (*AuditReport, error)

CreateCertificateAuthorityAuditReport creates a new audit report for the given CA.

func (*InMemoryBackend) CreatePermission 

func (b *InMemoryBackend) CreatePermission(
	ctx context.Context,
	caARN string,
	principal string,
	sourceAccount string,
	actions []string,
) (*Permission, error)

CreatePermission creates a permission on the given CA.

func (*InMemoryBackend) DeleteCertificateAuthority 

func (b *InMemoryBackend) DeleteCertificateAuthority(
	ctx context.Context, caARN string, permanentDeletionDays int32,
) error

DeleteCertificateAuthority marks the CA as DELETED.

func (*InMemoryBackend) DeletePermission 

func (b *InMemoryBackend) DeletePermission(ctx context.Context, caARN, principal, sourceAccount string) error

DeletePermission deletes a permission on the given CA.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(ctx context.Context, caARN string) error

DeletePolicy deletes the resource policy for the given CA.

func (*InMemoryBackend) DescribeCertificateAuthority 

func (b *InMemoryBackend) DescribeCertificateAuthority(
	ctx context.Context, caARN string,
) (*CertificateAuthority, error)

DescribeCertificateAuthority returns the CA with the given ARN.

func (*InMemoryBackend) DescribeCertificateAuthorityAuditReport 

func (b *InMemoryBackend) DescribeCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	auditReportID string,
) (*AuditReport, error)

DescribeCertificateAuthorityAuditReport returns the audit report for the given CA.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, caARN, certARN string) (*IssuedCertificate, error)

GetCertificate returns the certificate for the given CA and certificate ARN. It validates that the certificate belongs to the specified CA.

func (*InMemoryBackend) GetCertificateAuthorityCertificate 

func (b *InMemoryBackend) GetCertificateAuthorityCertificate(
	ctx context.Context, caARN string,
) (string, string, error)

GetCertificateAuthorityCertificate returns the certificate body and chain PEM for the given CA.

func (*InMemoryBackend) GetCertificateAuthorityCsr 

func (b *InMemoryBackend) GetCertificateAuthorityCsr(ctx context.Context, caARN string) (string, error)

GetCertificateAuthorityCsr returns the CSR PEM for the given CA.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(ctx context.Context, caARN string) (string, error)

GetPolicy returns the resource policy for the given CA.

func (*InMemoryBackend) ImportCertificateAuthorityCertificate 

func (b *InMemoryBackend) ImportCertificateAuthorityCertificate(
	ctx context.Context, caARN, certPEM, chainPEM string,
) error

ImportCertificateAuthorityCertificate imports a signed certificate for the CA, activating it. It parses the certificate to extract NotBefore/NotAfter and stores the optional chain.

func (*InMemoryBackend) IssueCertificate 

func (b *InMemoryBackend) IssueCertificate(
	ctx context.Context, caARN, csrPEM string, validityDays int, opts ...IssueCertOption,
) (*IssuedCertificate, error)

IssueCertificate issues a new certificate signed by the given CA.

func (*InMemoryBackend) ListCertificateAuthorities 

func (b *InMemoryBackend) ListCertificateAuthorities(
	ctx context.Context, nextToken string, maxItems int, resourceOwner string,
) (page.Page[CertificateAuthority], error)

ListCertificateAuthorities returns a paginated list of CAs sorted by ARN. resourceOwner mirrors ListCertificateAuthoritiesInput.ResourceOwner: SELF (or empty, the real API's default) lists CAs owned by this account; OTHER_ACCOUNTS always returns an empty page, since gopherstack does not model cross-account CA sharing (no CA here is ever owned by another account -- see PARITY.md).

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context,
	caARN string,
	nextToken string,
	maxItems int,
) page.Page[IssuedCertificate]

ListCertificates returns a paginated list of certificates issued by the given CA.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	ctx context.Context, caARN, nextToken string, maxItems int,
) (page.Page[Permission], error)

ListPermissions lists permissions on the given CA.

func (*InMemoryBackend) PutPolicy 

func (b *InMemoryBackend) PutPolicy(ctx context.Context, caARN, policy string) error

PutPolicy stores a resource policy on the given CA.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificateAuthority 

func (b *InMemoryBackend) RestoreCertificateAuthority(ctx context.Context, caARN string) error

RestoreCertificateAuthority restores a deleted CA into the DISABLED state.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, caARN, serial, revocationReason string) error

RevokeCertificate revokes the given certificate using the O(1) serial index.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateCertificateAuthority 

func (b *InMemoryBackend) UpdateCertificateAuthority(
	ctx context.Context, caARN, status string, opts ...UpdateCAOption,
) error

UpdateCertificateAuthority updates the CA status and/or revocation configuration.

type IssueCertOption added in v1.2.0 

type IssueCertOption func(*issueCertOptions)

IssueCertOption customizes IssueCertificate. See WithIssueCert* below.

func WithIssueCertAPIPassthrough added in v1.2.0 

func WithIssueCertAPIPassthrough(ap *APIPassthrough) IssueCertOption

WithIssueCertAPIPassthrough applies custom subject/extension overrides, honored only when the request's TemplateArn selects an APIPassthrough/ APICSRPassthrough template variant (see resolveTemplateArn).

func WithIssueCertIdempotencyToken added in v1.2.0 

func WithIssueCertIdempotencyToken(token string) IssueCertOption

WithIssueCertIdempotencyToken deduplicates repeated IssueCertificate calls bearing the same token within a 5-minute window: the original certificate's ARN is returned instead of issuing a duplicate.

func WithIssueCertTemplateArn added in v1.2.0 

func WithIssueCertTemplateArn(templateArn string) IssueCertOption

WithIssueCertTemplateArn selects a certificate template: its per-family fixed X.509 extension profile (KeyUsage/ExtendedKeyUsage/BasicConstraints) and APIPassthrough/CSRPassthrough gating -- see resolveTemplateArn.

func WithIssueCertValidityNotBefore added in v1.2.0 

func WithIssueCertValidityNotBefore(notBefore time.Time) IssueCertOption

WithIssueCertValidityNotBefore overrides the certificate's "Not Before" date (default: issuance time).

type IssuedCertificate 

type IssuedCertificate struct {
	IssuedAt         time.Time  `json:"issuedAt"`
	NotBefore        time.Time  `json:"notBefore"`
	NotAfter         time.Time  `json:"notAfter"`
	RevokedAt        *time.Time `json:"revokedAt,omitempty"`
	ARN              string     `json:"arn"`
	CAARN            string     `json:"caArn"`
	Status           string     `json:"status"`
	Serial           string     `json:"serial"`
	CertBody         string     `json:"certBody"`
	RevocationReason string     `json:"revocationReason,omitempty"`
	// contains filtered or unexported fields
}

IssuedCertificate represents a certificate issued by an ACM PCA Certificate Authority.

type OcspConfiguration added in v1.2.0 

type OcspConfiguration struct {
	OcspCustomCname string `json:"ocspCustomCname,omitempty"`
	Enabled         bool   `json:"enabled"`
}

OcspConfiguration mirrors aws-sdk-go-v2 types.OcspConfiguration: Online Certificate Status Protocol settings for a CA.

type Permission 

type Permission struct {
	CreatedAt               time.Time `json:"createdAt"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	Policy                  string    `json:"policy,omitempty"`
	Principal               string    `json:"principal"`
	SourceAccount           string    `json:"sourceAccount,omitempty"`

	Actions []string `json:"actions"`
	// contains filtered or unexported fields
}

Permission represents an ACM PCA permission granted on a certificate authority.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM PCA.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM PCA service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RevocationConfiguration added in v1.2.0 

type RevocationConfiguration struct {
	CrlConfiguration  *CrlConfiguration  `json:"crlConfiguration,omitempty"`
	OcspConfiguration *OcspConfiguration `json:"ocspConfiguration,omitempty"`
}

RevocationConfiguration mirrors aws-sdk-go-v2 types.RevocationConfiguration: the combined CRL/OCSP configuration reported by DescribeCertificateAuthority and accepted by CreateCertificateAuthority/UpdateCertificateAuthority.

type UpdateCAOption added in v1.2.0 

type UpdateCAOption func(*updateCAOptions)

UpdateCAOption customizes UpdateCertificateAuthority. See WithUpdateCA* below.

func WithUpdateCARevocationConfiguration added in v1.2.0 

func WithUpdateCARevocationConfiguration(rc *RevocationConfiguration) UpdateCAOption

WithUpdateCARevocationConfiguration replaces the CA's CRL/OCSP configuration. Per the real API, omitting this option entirely (the zero-value default) leaves the CA's existing RevocationConfiguration unchanged; passing rc (even nil, meaning "clear it") always overwrites it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.