acmpca

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 29 Imported by: 0

README

ACM PCA

Parity grade: A · SDK aws-sdk-go-v2/service/acmpca@v1.46.10 · last audited 2026-07-13 (87c87b39)

Coverage

Metric Value
Operations audited 23 (22 ok, 1 partial)
Known gaps 8
Deferred items 2
Resource leaks clean
Known gaps
  • CreateCertificateAuthority/IssueCertificate IdempotencyToken is accepted but not deduplicated (no 5-minute idempotency window)
  • ListCertificateAuthorities ResourceOwner filter (SELF vs OTHER_ACCOUNTS) is accepted but ignored — no cross-account CA sharing model exists
  • ListTags does not paginate (MaxResults/NextToken accepted but the full tag set is always returned in one page) — low risk since AWS caps tags at 50 per CA
  • RevocationConfiguration (CRL/OCSP) is not modeled at all: CreateCertificateAuthority/UpdateCertificateAuthority accept no such input, RevokeCertificate never checks for it, DescribeCertificateAuthority always reports an empty RevocationConfiguration object
  • DeleteCertificateAuthority/RestoreCertificateAuthority: RestorableUntil is now tracked and reported, but there is no background sweep that permanently removes a CA once RestorableUntil passes, and RestoreCertificateAuthority does not reject a restore attempted after that deadline
  • TagCertificateAuthority does not enforce the 50-tag-per-CA limit (TooManyTagsException never returned)
  • Principal validation on CreatePermission does not restrict to "acm.amazonaws.com" (the only real-world valid principal per AWS docs)
  • CA ARNs use a 32-char hex ID (crypto/rand) rather than AWS's UUID-with-dashes format; opaque to SDK clients so functionally harmless, but a client-side regex validating ARN shape against the literal AWS UUID pattern would reject it
Deferred
  • APIPassthrough / custom X.509 extensions on IssueCertificate (templates) — not implemented, Extensions/ApiPassthrough input silently ignored
  • TemplateArn on IssueCertificate — silently ignored

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrCANotFound is returned when a Certificate Authority is not found.
	ErrCANotFound = errors.New("ResourceNotFoundException")
	// ErrCertNotFound is returned when an issued certificate is not found.
	ErrCertNotFound = errors.New("ResourceNotFoundException")
	// ErrInvalidParameter is returned when an invalid parameter is provided.
	ErrInvalidParameter = errors.New("InvalidParameterException")
	// ErrInvalidState is returned when the CA is in an invalid state for the operation.
	ErrInvalidState = errors.New("InvalidStateException")
	// ErrPermissionNotFound is returned when a CA permission is not found.
	ErrPermissionNotFound = errors.New("ResourceNotFoundException")
	// ErrPermissionAlreadyExists is returned when a permission for the same
	// principal/source-account pair already exists on the CA.
	ErrPermissionAlreadyExists = errors.New("PermissionAlreadyExistsException")
	// ErrPolicyNotFound is returned when a CA policy is not found.
	ErrPolicyNotFound = errors.New("ResourceNotFoundException")
	// ErrAuditReportNotFound is returned when a CA audit report is not found.
	ErrAuditReportNotFound = errors.New("ResourceNotFoundException")
)

Functions

This section is empty.

Types

type AuditReport 

type AuditReport struct {
	CreatedAt               time.Time `json:"createdAt"`
	AuditReportID           string    `json:"auditReportId"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	S3BucketName            string    `json:"s3BucketName"`
	S3Key                   string    `json:"s3Key"`
	Status                  string    `json:"status"`
	// contains filtered or unexported fields
}

AuditReport represents an ACM PCA audit report generated for a certificate authority.

type CertificateAuthority 

type CertificateAuthority struct {
	CreatedAt time.Time `json:"createdAt"`
	NotBefore time.Time `json:"notBefore"`
	NotAfter  time.Time `json:"notAfter"`
	// RestorableUntil is the end of the restoration window while the CA is
	// DELETED (see DeleteCertificateAuthority); zero once the CA is not DELETED.
	RestorableUntil time.Time `json:"restorableUntil"`

	CertificateAuthorityConfiguration CertificateAuthorityConfiguration `json:"certificateAuthorityConfiguration"`
	ARN                               string                            `json:"arn"`
	OwnerAccount                      string                            `json:"ownerAccount"`
	Type                              string                            `json:"type"`
	Status                            string                            `json:"status"`
	Serial                            string                            `json:"serial,omitempty"`
	CertificateBody                   string                            `json:"certificateBody,omitempty"`
	CertificateChain                  string                            `json:"certificateChain,omitempty"`
	CSR                               string                            `json:"csr,omitempty"`
	// contains filtered or unexported fields
}

CertificateAuthority represents an ACM PCA Certificate Authority.

type CertificateAuthorityConfiguration 

type CertificateAuthorityConfiguration struct {
	Subject          CertificateAuthoritySubject `json:"Subject"`
	KeyAlgorithm     string                      `json:"KeyAlgorithm"`
	SigningAlgorithm string                      `json:"SigningAlgorithm"`
}

CertificateAuthorityConfiguration holds the configuration for a Certificate Authority.

type CertificateAuthoritySubject 

type CertificateAuthoritySubject struct {
	CommonName         string `json:"CommonName,omitempty"`
	Country            string `json:"Country,omitempty"`
	Organization       string `json:"Organization,omitempty"`
	OrganizationalUnit string `json:"OrganizationalUnit,omitempty"`
	State              string `json:"State,omitempty"`
	Locality           string `json:"Locality,omitempty"`
}

CertificateAuthoritySubject holds the subject fields for a Certificate Authority.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM PCA operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM PCA handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM PCA instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM PCA action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the primary ARN from the JSON body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported ACM PCA operations.

func (*Handler) GetTagsForTest 

func (h *Handler) GetTagsForTest(resourceID string) []map[string]string

GetTagsForTest is a test helper that returns all tags for a resource by ARN.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM PCA JSON-protocol requests.

func (*Handler) SetTagsForTest 

func (h *Handler) SetTagsForTest(resourceID string, kv map[string]string)

SetTagsForTest is a test helper that sets tags for a resource by ARN.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM PCA resources.

The CA/certificate/permission/audit-report collections below were previously nested by region (outer key = region, e.g. map[string]map[string]*CertificateAuthority) so that same-ARN-shaped resources in different regions were fully isolated. Phase 3.3 of the datalayer refactor replaces each of those with a flat *store.Table, keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping certs/permissions by (region, CA ARN) for the CA-scoped list operations -- the same region-qualified-table pattern services/emr/services/neptune/services/mwaa use. certsByCASerial (a derived, rebuilt-on-Restore lookup of bare strings with no identity of their own) and policies (a bare string value with no identity struct) are deliberately NOT converted to store.Table: store.Table requires a *V value with its own identity, which neither has; they remain plain region-nested maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) CreateCertificateAuthority 

func (b *InMemoryBackend) CreateCertificateAuthority(
	ctx context.Context,
	caType string,
	cfg CertificateAuthorityConfiguration,
) (*CertificateAuthority, error)

CreateCertificateAuthority creates a new Certificate Authority.

func (*InMemoryBackend) CreateCertificateAuthorityAuditReport 

func (b *InMemoryBackend) CreateCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	s3BucketName string,
	responseFormat string,
) (*AuditReport, error)

CreateCertificateAuthorityAuditReport creates a new audit report for the given CA.

func (*InMemoryBackend) CreatePermission 

func (b *InMemoryBackend) CreatePermission(
	ctx context.Context,
	caARN string,
	principal string,
	sourceAccount string,
	actions []string,
) (*Permission, error)

CreatePermission creates a permission on the given CA.

func (*InMemoryBackend) DeleteCertificateAuthority 

func (b *InMemoryBackend) DeleteCertificateAuthority(
	ctx context.Context, caARN string, permanentDeletionDays int32,
) error

DeleteCertificateAuthority marks the CA as DELETED.

func (*InMemoryBackend) DeletePermission 

func (b *InMemoryBackend) DeletePermission(ctx context.Context, caARN, principal, sourceAccount string) error

DeletePermission deletes a permission on the given CA.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(ctx context.Context, caARN string) error

DeletePolicy deletes the resource policy for the given CA.

func (*InMemoryBackend) DescribeCertificateAuthority 

func (b *InMemoryBackend) DescribeCertificateAuthority(
	ctx context.Context, caARN string,
) (*CertificateAuthority, error)

DescribeCertificateAuthority returns the CA with the given ARN.

func (*InMemoryBackend) DescribeCertificateAuthorityAuditReport 

func (b *InMemoryBackend) DescribeCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	auditReportID string,
) (*AuditReport, error)

DescribeCertificateAuthorityAuditReport returns the audit report for the given CA.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, caARN, certARN string) (*IssuedCertificate, error)

GetCertificate returns the certificate for the given CA and certificate ARN. It validates that the certificate belongs to the specified CA.

func (*InMemoryBackend) GetCertificateAuthorityCertificate 

func (b *InMemoryBackend) GetCertificateAuthorityCertificate(
	ctx context.Context, caARN string,
) (string, string, error)

GetCertificateAuthorityCertificate returns the certificate body and chain PEM for the given CA.

func (*InMemoryBackend) GetCertificateAuthorityCsr 

func (b *InMemoryBackend) GetCertificateAuthorityCsr(ctx context.Context, caARN string) (string, error)

GetCertificateAuthorityCsr returns the CSR PEM for the given CA.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(ctx context.Context, caARN string) (string, error)

GetPolicy returns the resource policy for the given CA.

func (*InMemoryBackend) ImportCertificateAuthorityCertificate 

func (b *InMemoryBackend) ImportCertificateAuthorityCertificate(
	ctx context.Context, caARN, certPEM, chainPEM string,
) error

ImportCertificateAuthorityCertificate imports a signed certificate for the CA, activating it. It parses the certificate to extract NotBefore/NotAfter and stores the optional chain.

func (*InMemoryBackend) IssueCertificate 

func (b *InMemoryBackend) IssueCertificate(
	ctx context.Context, caARN, csrPEM string, validityDays int,
) (*IssuedCertificate, error)

IssueCertificate issues a new certificate signed by the given CA.

func (*InMemoryBackend) ListCertificateAuthorities 

func (b *InMemoryBackend) ListCertificateAuthorities(
	ctx context.Context, nextToken string, maxItems int,
) page.Page[CertificateAuthority]

ListCertificateAuthorities returns a paginated list of CAs sorted by ARN.

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context,
	caARN string,
	nextToken string,
	maxItems int,
) page.Page[IssuedCertificate]

ListCertificates returns a paginated list of certificates issued by the given CA.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	ctx context.Context, caARN, nextToken string, maxItems int,
) (page.Page[Permission], error)

ListPermissions lists permissions on the given CA.

func (*InMemoryBackend) PutPolicy 

func (b *InMemoryBackend) PutPolicy(ctx context.Context, caARN, policy string) error

PutPolicy stores a resource policy on the given CA.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificateAuthority 

func (b *InMemoryBackend) RestoreCertificateAuthority(ctx context.Context, caARN string) error

RestoreCertificateAuthority restores a deleted CA into the DISABLED state.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, caARN, serial, revocationReason string) error

RevokeCertificate revokes the given certificate using the O(1) serial index.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateCertificateAuthority 

func (b *InMemoryBackend) UpdateCertificateAuthority(ctx context.Context, caARN, status string) error

UpdateCertificateAuthority updates the CA status.

type IssuedCertificate 

type IssuedCertificate struct {
	IssuedAt         time.Time  `json:"issuedAt"`
	NotBefore        time.Time  `json:"notBefore"`
	NotAfter         time.Time  `json:"notAfter"`
	RevokedAt        *time.Time `json:"revokedAt,omitempty"`
	ARN              string     `json:"arn"`
	CAARN            string     `json:"caArn"`
	Status           string     `json:"status"`
	Serial           string     `json:"serial"`
	CertBody         string     `json:"certBody"`
	RevocationReason string     `json:"revocationReason,omitempty"`
	// contains filtered or unexported fields
}

IssuedCertificate represents a certificate issued by an ACM PCA Certificate Authority.

type Permission 

type Permission struct {
	CreatedAt               time.Time `json:"createdAt"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	Policy                  string    `json:"policy,omitempty"`
	Principal               string    `json:"principal"`
	SourceAccount           string    `json:"sourceAccount,omitempty"`

	Actions []string `json:"actions"`
	// contains filtered or unexported fields
}

Permission represents an ACM PCA permission granted on a certificate authority.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM PCA.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM PCA service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.