acmpca

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 34 Imported by: 0

README

ACM PCA

Parity grade: A · SDK aws-sdk-go-v2/service/acmpca@v1.46.10 · last audited 2026-07-23 (1c4ee34e)

Coverage

Metric Value
Operations audited 23 (23 ok)
Known gaps 7
Deferred items 0
Resource leaks clean
Known gaps
  • ApiPassthrough.Extensions.CertificatePolicies is rejected (InvalidParameterException) rather than implemented -- would require arbitrary OID/PolicyQualifier ASN.1 encoding beyond a simple pkix.Extension passthrough
  • ApiPassthrough.Subject's exotic RDN types (DistinguishedNameQualifier, GenerationQualifier, Initials, Pseudonym, Surname, Title, CustomAttributes) are rejected rather than implemented -- crypto/x509's pkix.Name has no direct fields for most of these
  • ApiPassthrough.Extensions.SubjectAlternativeNames' exotic GeneralName variants (OtherName, DirectoryName, EdiPartyName, UniformResourceIdentifier, RegisteredId) are rejected rather than implemented -- only DnsName/IpAddress/Rfc822Name (the three Terraform's aws_acmpca_certificate resource actually exposes) are modeled
  • TemplateArn's per-template default X.509 extension profile (e.g. SubordinateCACertificate_PathLenN's CA path-length constraint, OCSPSigningCertificate/CodeSigningCertificate's preset KeyUsage/ExtendedKeyUsage) is not modeled; only the documented APIPassthrough/APICSRPassthrough-gating behavior (whether ApiPassthrough is honored at all) is implemented -- every issued cert uses the same flat extension baseline (optionally overridden by ApiPassthrough) regardless of TemplateArn's specific value
  • RevocationConfiguration.CrlConfiguration/OcspConfiguration's CNAME fields (CustomCname, OcspCustomCname) and S3BucketName are accepted as any non-empty string; the real API's RFC2396/S3-bucket-naming-rule validation is not enforced
  • IssueCertificate's END_DATE validity type is still treated as Unix epoch seconds (same as ABSOLUTE) rather than true UTCTime/GeneralizedTime -- pre-existing intentional simplification, not touched this pass (see Traps)
  • DELETED CAs past their RestorableUntil deadline are hidden from every read path (Describe/List/Get/Issue/etc. all treat them as not-found, matching real AWS's user-visible behavior) and RestoreCertificateAuthority correctly rejects them, but the row is not physically freed from the in-memory store.Table until the next process Reset() -- consistent with how every other terminal-state resource in this backend (revoked certs, etc.) is retained rather than garbage-collected; not a new leak, just not a true memory-reclaiming sweep

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrCANotFound is returned when a Certificate Authority is not found.
	ErrCANotFound = errors.New("ResourceNotFoundException")
	// ErrCertNotFound is returned when an issued certificate is not found.
	ErrCertNotFound = errors.New("ResourceNotFoundException")
	// ErrInvalidParameter is returned when an invalid parameter is provided.
	ErrInvalidParameter = errors.New("InvalidParameterException")
	// ErrInvalidState is returned when the CA is in an invalid state for the operation.
	ErrInvalidState = errors.New("InvalidStateException")
	// ErrPermissionNotFound is returned when a CA permission is not found.
	ErrPermissionNotFound = errors.New("ResourceNotFoundException")
	// ErrPermissionAlreadyExists is returned when a permission for the same
	// principal/source-account pair already exists on the CA.
	ErrPermissionAlreadyExists = errors.New("PermissionAlreadyExistsException")
	// ErrPolicyNotFound is returned when a CA policy is not found.
	ErrPolicyNotFound = errors.New("ResourceNotFoundException")
	// ErrAuditReportNotFound is returned when a CA audit report is not found.
	ErrAuditReportNotFound = errors.New("ResourceNotFoundException")
	// ErrTooManyTags is returned when tagging a CA would exceed the 50-tag limit.
	ErrTooManyTags = errors.New("TooManyTagsException")
)

Functions

This section is empty.

Types

type APIPassthrough added in v1.2.0 

type APIPassthrough struct {
	Subject    *APIPassthroughSubject
	Extensions *APIPassthroughExtensions
}

APIPassthrough mirrors aws-sdk-go-v2 types.APIPassthrough: the subject and X.509 extension overrides IssueCertificate applies when the request's TemplateArn selects an APIPassthrough/APICSRPassthrough template variant (see decodeAPIPassthrough in handler_certificates.go for that gating).

type APIPassthroughCustomExtension added in v1.2.0 

type APIPassthroughCustomExtension struct {
	ObjectIdentifier string
	ValueBase64      string
	Critical         bool
}

APIPassthroughCustomExtension mirrors aws-sdk-go-v2 types.CustomExtension: an arbitrary X.509 extension identified by OID, carrying an already-DER-encoded value the caller supplies verbatim (base64 on the wire).

type APIPassthroughExtendedKeyUsage added in v1.2.0 

type APIPassthroughExtendedKeyUsage struct {
	Type             string
	ObjectIdentifier string
}

APIPassthroughExtendedKeyUsage mirrors aws-sdk-go-v2 types.ExtendedKeyUsage: exactly one of Type (a standard ExtendedKeyUsageType) or ObjectIdentifier (a custom OID) is set.

type APIPassthroughExtensions added in v1.2.0 

type APIPassthroughExtensions struct {
	KeyUsage                *APIPassthroughKeyUsage
	ExtendedKeyUsage        []APIPassthroughExtendedKeyUsage
	SubjectAlternativeNames []APIPassthroughSAN
	CustomExtensions        []APIPassthroughCustomExtension
}

APIPassthroughExtensions mirrors aws-sdk-go-v2 types.Extensions. CertificatePolicies is intentionally not modeled -- see decodeExtensions in handler_certificates.go, which rejects it explicitly (OID/PolicyQualifier ASN.1 encoding not implemented; PARITY.md tracks this as still-open).

type APIPassthroughKeyUsage added in v1.2.0 

type APIPassthroughKeyUsage struct {
	DigitalSignature bool
	NonRepudiation   bool
	KeyEncipherment  bool
	DataEncipherment bool
	KeyAgreement     bool
	KeyCertSign      bool
	CRLSign          bool
	EncipherOnly     bool
	DecipherOnly     bool
}

APIPassthroughKeyUsage mirrors aws-sdk-go-v2 types.KeyUsage.

type APIPassthroughSAN added in v1.2.0 

type APIPassthroughSAN struct {
	DNSName      string
	IPAddress    string
	EmailAddress string
}

APIPassthroughSAN mirrors the DnsName/IpAddress/Rfc822Name variants of aws-sdk-go-v2 types.GeneralName -- the three SubjectAlternativeNames variants Terraform's aws_acmpca_certificate resource exposes. The remaining GeneralName variants (OtherName, DirectoryName, EdiPartyName, UniformResourceIdentifier, RegisteredId) are intentionally not modeled -- see decodeGeneralName in handler_certificates.go, which rejects them explicitly.

type APIPassthroughSubject added in v1.2.0 

type APIPassthroughSubject struct {
	CommonName         string
	Country            string
	Organization       string
	OrganizationalUnit string
	State              string
	Locality           string
	SerialNumber       string
}

APIPassthroughSubject overrides the CSR-derived certificate subject with explicit X.500 attributes, mirroring the commonly-used fields of aws-sdk-go-v2 types.ASN1Subject. The exotic RDN types (DistinguishedNameQualifier, GenerationQualifier, Initials, Pseudonym, Surname, Title, CustomAttributes) are intentionally not modeled -- see decodeASN1Subject in handler_certificates.go, which rejects them explicitly rather than silently dropping them.

type AuditReport 

type AuditReport struct {
	CreatedAt               time.Time `json:"createdAt"`
	AuditReportID           string    `json:"auditReportId"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	S3BucketName            string    `json:"s3BucketName"`
	S3Key                   string    `json:"s3Key"`
	Status                  string    `json:"status"`
	// contains filtered or unexported fields
}

AuditReport represents an ACM PCA audit report generated for a certificate authority.

type CertificateAuthority 

type CertificateAuthority struct {
	CreatedAt time.Time `json:"createdAt"`
	NotBefore time.Time `json:"notBefore"`
	NotAfter  time.Time `json:"notAfter"`
	// RestorableUntil is the end of the restoration window while the CA is
	// DELETED (see DeleteCertificateAuthority); zero once the CA is not DELETED.
	RestorableUntil time.Time `json:"restorableUntil"`
	// LastStateChangeAt is updated on every operation that changes Status or
	// the CA's certificate material (Create, Import, self-sign-activate,
	// Update, Delete, Restore), mirroring types.CertificateAuthority's
	// LastStateChangeAt field.
	LastStateChangeAt time.Time `json:"lastStateChangeAt"`

	CertificateAuthorityConfiguration CertificateAuthorityConfiguration `json:"certificateAuthorityConfiguration"`
	// RevocationConfiguration holds the CRL/OCSP settings accepted by
	// CreateCertificateAuthority/UpdateCertificateAuthority; nil means "not
	// configured" (DescribeCertificateAuthority omits the field entirely, as
	// the real SDK does for a nil *types.RevocationConfiguration).
	RevocationConfiguration *RevocationConfiguration `json:"revocationConfiguration,omitempty"`
	ARN                     string                   `json:"arn"`
	OwnerAccount            string                   `json:"ownerAccount"`
	Type                    string                   `json:"type"`
	Status                  string                   `json:"status"`
	// KeyStorageSecurityStandard mirrors types.KeyStorageSecurityStandard;
	// defaults to FIPS_140_2_LEVEL_3_OR_HIGHER, matching the real API's default.
	KeyStorageSecurityStandard string `json:"keyStorageSecurityStandard,omitempty"`
	// UsageMode mirrors types.CertificateAuthorityUsageMode; defaults to
	// GENERAL_PURPOSE. When SHORT_LIVED_CERTIFICATE, IssueCertificate enforces
	// the real API's 7-day validity cap for certificates issued by this CA.
	UsageMode        string `json:"usageMode,omitempty"`
	Serial           string `json:"serial,omitempty"`
	CertificateBody  string `json:"certificateBody,omitempty"`
	CertificateChain string `json:"certificateChain,omitempty"`
	CSR              string `json:"csr,omitempty"`
	// contains filtered or unexported fields
}

CertificateAuthority represents an ACM PCA Certificate Authority.

type CertificateAuthorityConfiguration 

type CertificateAuthorityConfiguration struct {
	Subject          CertificateAuthoritySubject `json:"Subject"`
	KeyAlgorithm     string                      `json:"KeyAlgorithm"`
	SigningAlgorithm string                      `json:"SigningAlgorithm"`
}

CertificateAuthorityConfiguration holds the configuration for a Certificate Authority.

type CertificateAuthoritySubject 

type CertificateAuthoritySubject struct {
	CommonName         string `json:"CommonName,omitempty"`
	Country            string `json:"Country,omitempty"`
	Organization       string `json:"Organization,omitempty"`
	OrganizationalUnit string `json:"OrganizationalUnit,omitempty"`
	State              string `json:"State,omitempty"`
	Locality           string `json:"Locality,omitempty"`
}

CertificateAuthoritySubject holds the subject fields for a Certificate Authority.

type CreateCAOption added in v1.2.0 

type CreateCAOption func(*createCAOptions)

CreateCAOption customizes CreateCertificateAuthority. See WithCreateCA* below.

func WithCreateCAIdempotencyToken added in v1.2.0 

func WithCreateCAIdempotencyToken(token string) CreateCAOption

WithCreateCAIdempotencyToken deduplicates repeated CreateCertificateAuthority calls bearing the same token within a 5-minute window: the original CA's ARN is returned instead of creating a duplicate.

func WithCreateCAKeyStorageSecurityStandard added in v1.2.0 

func WithCreateCAKeyStorageSecurityStandard(std string) CreateCAOption

WithCreateCAKeyStorageSecurityStandard sets KeyStorageSecurityStandard.

func WithCreateCARevocationConfiguration added in v1.2.0 

func WithCreateCARevocationConfiguration(rc *RevocationConfiguration) CreateCAOption

WithCreateCARevocationConfiguration sets the CA's initial CRL/OCSP configuration.

func WithCreateCAUsageMode added in v1.2.0 

func WithCreateCAUsageMode(mode string) CreateCAOption

WithCreateCAUsageMode sets UsageMode (GENERAL_PURPOSE or SHORT_LIVED_CERTIFICATE).

type CrlConfiguration added in v1.2.0 

type CrlConfiguration struct {
	CustomCname      string `json:"customCname,omitempty"`
	CustomPath       string `json:"customPath,omitempty"`
	S3BucketName     string `json:"s3BucketName,omitempty"`
	S3ObjectACL      string `json:"s3ObjectAcl,omitempty"`
	CrlType          string `json:"crlType,omitempty"`
	ExpirationInDays int32  `json:"expirationInDays,omitempty"`
	Enabled          bool   `json:"enabled"`
	OmitExtension    bool   `json:"omitExtension,omitempty"`
}

CrlConfiguration mirrors aws-sdk-go-v2 types.CrlConfiguration: certificate revocation list settings for a CA. CrlDistributionPointExtensionConfiguration is flattened into OmitExtension (its only field).

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM PCA operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM PCA handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM PCA instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM PCA action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the primary ARN from the JSON body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported ACM PCA operations.

func (*Handler) GetTagsForTest 

func (h *Handler) GetTagsForTest(resourceID string) []map[string]string

GetTagsForTest is a test helper that returns all tags for a resource by ARN.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM PCA JSON-protocol requests.

func (*Handler) SetTagsForTest 

func (h *Handler) SetTagsForTest(resourceID string, kv map[string]string)

SetTagsForTest is a test helper that sets tags for a resource by ARN.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM PCA resources.

The CA/certificate/permission/audit-report collections below were previously nested by region (outer key = region, e.g. map[string]map[string]*CertificateAuthority) so that same-ARN-shaped resources in different regions were fully isolated. Phase 3.3 of the datalayer refactor replaces each of those with a flat *store.Table, keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping certs/permissions by (region, CA ARN) for the CA-scoped list operations -- the same region-qualified-table pattern services/emr/services/neptune/services/mwaa use. certsByCASerial (a derived, rebuilt-on-Restore lookup of bare strings with no identity of their own) and policies (a bare string value with no identity struct) are deliberately NOT converted to store.Table: store.Table requires a *V value with its own identity, which neither has; they remain plain region-nested maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) CreateCertificateAuthority 

func (b *InMemoryBackend) CreateCertificateAuthority(
	ctx context.Context,
	caType string,
	cfg CertificateAuthorityConfiguration,
	opts ...CreateCAOption,
) (*CertificateAuthority, error)

CreateCertificateAuthority creates a new Certificate Authority.

func (*InMemoryBackend) CreateCertificateAuthorityAuditReport 

func (b *InMemoryBackend) CreateCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	s3BucketName string,
	responseFormat string,
) (*AuditReport, error)

CreateCertificateAuthorityAuditReport creates a new audit report for the given CA.

func (*InMemoryBackend) CreatePermission 

func (b *InMemoryBackend) CreatePermission(
	ctx context.Context,
	caARN string,
	principal string,
	sourceAccount string,
	actions []string,
) (*Permission, error)

CreatePermission creates a permission on the given CA.

func (*InMemoryBackend) DeleteCertificateAuthority 

func (b *InMemoryBackend) DeleteCertificateAuthority(
	ctx context.Context, caARN string, permanentDeletionDays int32,
) error

DeleteCertificateAuthority marks the CA as DELETED.

func (*InMemoryBackend) DeletePermission 

func (b *InMemoryBackend) DeletePermission(ctx context.Context, caARN, principal, sourceAccount string) error

DeletePermission deletes a permission on the given CA.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(ctx context.Context, caARN string) error

DeletePolicy deletes the resource policy for the given CA.

func (*InMemoryBackend) DescribeCertificateAuthority 

func (b *InMemoryBackend) DescribeCertificateAuthority(
	ctx context.Context, caARN string,
) (*CertificateAuthority, error)

DescribeCertificateAuthority returns the CA with the given ARN.

func (*InMemoryBackend) DescribeCertificateAuthorityAuditReport 

func (b *InMemoryBackend) DescribeCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	auditReportID string,
) (*AuditReport, error)

DescribeCertificateAuthorityAuditReport returns the audit report for the given CA.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, caARN, certARN string) (*IssuedCertificate, error)

GetCertificate returns the certificate for the given CA and certificate ARN. It validates that the certificate belongs to the specified CA.

func (*InMemoryBackend) GetCertificateAuthorityCertificate 

func (b *InMemoryBackend) GetCertificateAuthorityCertificate(
	ctx context.Context, caARN string,
) (string, string, error)

GetCertificateAuthorityCertificate returns the certificate body and chain PEM for the given CA.

func (*InMemoryBackend) GetCertificateAuthorityCsr 

func (b *InMemoryBackend) GetCertificateAuthorityCsr(ctx context.Context, caARN string) (string, error)

GetCertificateAuthorityCsr returns the CSR PEM for the given CA.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(ctx context.Context, caARN string) (string, error)

GetPolicy returns the resource policy for the given CA.

func (*InMemoryBackend) ImportCertificateAuthorityCertificate 

func (b *InMemoryBackend) ImportCertificateAuthorityCertificate(
	ctx context.Context, caARN, certPEM, chainPEM string,
) error

ImportCertificateAuthorityCertificate imports a signed certificate for the CA, activating it. It parses the certificate to extract NotBefore/NotAfter and stores the optional chain.

func (*InMemoryBackend) IssueCertificate 

func (b *InMemoryBackend) IssueCertificate(
	ctx context.Context, caARN, csrPEM string, validityDays int, opts ...IssueCertOption,
) (*IssuedCertificate, error)

IssueCertificate issues a new certificate signed by the given CA.

func (*InMemoryBackend) ListCertificateAuthorities 

func (b *InMemoryBackend) ListCertificateAuthorities(
	ctx context.Context, nextToken string, maxItems int, resourceOwner string,
) (page.Page[CertificateAuthority], error)

ListCertificateAuthorities returns a paginated list of CAs sorted by ARN. resourceOwner mirrors ListCertificateAuthoritiesInput.ResourceOwner: SELF (or empty, the real API's default) lists CAs owned by this account; OTHER_ACCOUNTS always returns an empty page, since gopherstack does not model cross-account CA sharing (no CA here is ever owned by another account -- see PARITY.md).

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context,
	caARN string,
	nextToken string,
	maxItems int,
) page.Page[IssuedCertificate]

ListCertificates returns a paginated list of certificates issued by the given CA.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	ctx context.Context, caARN, nextToken string, maxItems int,
) (page.Page[Permission], error)

ListPermissions lists permissions on the given CA.

func (*InMemoryBackend) PutPolicy 

func (b *InMemoryBackend) PutPolicy(ctx context.Context, caARN, policy string) error

PutPolicy stores a resource policy on the given CA.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificateAuthority 

func (b *InMemoryBackend) RestoreCertificateAuthority(ctx context.Context, caARN string) error

RestoreCertificateAuthority restores a deleted CA into the DISABLED state.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, caARN, serial, revocationReason string) error

RevokeCertificate revokes the given certificate using the O(1) serial index.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateCertificateAuthority 

func (b *InMemoryBackend) UpdateCertificateAuthority(
	ctx context.Context, caARN, status string, opts ...UpdateCAOption,
) error

UpdateCertificateAuthority updates the CA status and/or revocation configuration.

type IssueCertOption added in v1.2.0 

type IssueCertOption func(*issueCertOptions)

IssueCertOption customizes IssueCertificate. See WithIssueCert* below.

func WithIssueCertAPIPassthrough added in v1.2.0 

func WithIssueCertAPIPassthrough(ap *APIPassthrough) IssueCertOption

WithIssueCertAPIPassthrough applies custom subject/extension overrides, honored only when the request's TemplateArn selects an APIPassthrough/ APICSRPassthrough template variant (see templateAllowsAPIPassthrough).

func WithIssueCertIdempotencyToken added in v1.2.0 

func WithIssueCertIdempotencyToken(token string) IssueCertOption

WithIssueCertIdempotencyToken deduplicates repeated IssueCertificate calls bearing the same token within a 5-minute window: the original certificate's ARN is returned instead of issuing a duplicate.

func WithIssueCertTemplateArn added in v1.2.0 

func WithIssueCertTemplateArn(templateArn string) IssueCertOption

WithIssueCertTemplateArn selects a certificate template. Only its APIPassthrough/APICSRPassthrough gating behavior is modeled (see templateAllowsAPIPassthrough): a non-passthrough template's APIPassthrough input is ignored, matching the real API's own documented behavior. Per-template default X.509 extension profiles are not modeled -- see PARITY.md.

func WithIssueCertValidityNotBefore added in v1.2.0 

func WithIssueCertValidityNotBefore(notBefore time.Time) IssueCertOption

WithIssueCertValidityNotBefore overrides the certificate's "Not Before" date (default: issuance time).

type IssuedCertificate 

type IssuedCertificate struct {
	IssuedAt         time.Time  `json:"issuedAt"`
	NotBefore        time.Time  `json:"notBefore"`
	NotAfter         time.Time  `json:"notAfter"`
	RevokedAt        *time.Time `json:"revokedAt,omitempty"`
	ARN              string     `json:"arn"`
	CAARN            string     `json:"caArn"`
	Status           string     `json:"status"`
	Serial           string     `json:"serial"`
	CertBody         string     `json:"certBody"`
	RevocationReason string     `json:"revocationReason,omitempty"`
	// contains filtered or unexported fields
}

IssuedCertificate represents a certificate issued by an ACM PCA Certificate Authority.

type OcspConfiguration added in v1.2.0 

type OcspConfiguration struct {
	OcspCustomCname string `json:"ocspCustomCname,omitempty"`
	Enabled         bool   `json:"enabled"`
}

OcspConfiguration mirrors aws-sdk-go-v2 types.OcspConfiguration: Online Certificate Status Protocol settings for a CA.

type Permission 

type Permission struct {
	CreatedAt               time.Time `json:"createdAt"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	Policy                  string    `json:"policy,omitempty"`
	Principal               string    `json:"principal"`
	SourceAccount           string    `json:"sourceAccount,omitempty"`

	Actions []string `json:"actions"`
	// contains filtered or unexported fields
}

Permission represents an ACM PCA permission granted on a certificate authority.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM PCA.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM PCA service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RevocationConfiguration added in v1.2.0 

type RevocationConfiguration struct {
	CrlConfiguration  *CrlConfiguration  `json:"crlConfiguration,omitempty"`
	OcspConfiguration *OcspConfiguration `json:"ocspConfiguration,omitempty"`
}

RevocationConfiguration mirrors aws-sdk-go-v2 types.RevocationConfiguration: the combined CRL/OCSP configuration reported by DescribeCertificateAuthority and accepted by CreateCertificateAuthority/UpdateCertificateAuthority.

type UpdateCAOption added in v1.2.0 

type UpdateCAOption func(*updateCAOptions)

UpdateCAOption customizes UpdateCertificateAuthority. See WithUpdateCA* below.

func WithUpdateCARevocationConfiguration added in v1.2.0 

func WithUpdateCARevocationConfiguration(rc *RevocationConfiguration) UpdateCAOption

WithUpdateCARevocationConfiguration replaces the CA's CRL/OCSP configuration. Per the real API, omitting this option entirely (the zero-value default) leaves the CA's existing RevocationConfiguration unchanged; passing rc (even nil, meaning "clear it") always overwrites it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.