acm

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 33 Imported by: 0

README

ACM

Parity grade: B · SDK aws-sdk-go-v2/service/acm@v1.43.0 · last audited 2026-07-25 (HEAD)

Coverage

Metric Value
Operations audited 38 (38 ok)
Known gaps 9
Deferred items 6
Resource leaks clean
Known gaps
  • ExportCertificate still unconditionally rejects AMAZON_ISSUED (public) certificates with RequestInProgressException, matching pre-2025 ACM behavior. Real AWS added "exportable public certificates" (public certs created after 2025-06-17 are exportable when Options.Export=ENABLED); Options.Export is now stored/validated/echoed correctly on the wire (RequestCertificate input, DescribeCertificate/ListCertificates output) but ExportCertificate does NOT yet gate AMAZON_ISSUED export on it. Not fixed this pass: the exact error code/condition AWS returns when a public cert lacks Export=ENABLED could not be confirmed from available documentation (RequestInProgressException's documented meaning is specifically "still pending validation", which would misrepresent this condition), and changing this risks fabricating an unverified error contract. Existing test TestACMHandler_ExportCertificate_AmazonIssued_Returns_RequestInProgressException locks in the current (conservative, pre-2025-parity) behavior.
  • CertificateDetail/CertificateSummary omit ManagedBy (AWS: which service, e.g. CLOUDFRONT, manages the cert) — no backend concept of CloudFront-managed certs exists; RequestCertificate's ManagedBy input field is also not accepted. Feature gap, not audited further this pass (field is optional on the real wire; omission is correct-by-absence for certs gopherstack never marks as managed).
  • ValidationMethod=HTTP (DomainValidation.HttpRedirect) is accepted as an input value but not given HTTP-specific handling -- buildInitialDVOList falls through to DNS-style ResourceRecord generation for any non-DNS/non-EMAIL method. Real AWS's HTTP validation method is documented as CloudFront-internal (HttpRedirect "exists only when the certificate type is AMAZON_ISSUED and the validation method is HTTP", set when CloudFront requests certs on a customer's behalf) rather than a method end users normally invoke directly; low value/high uncertainty, left unimplemented.
  • InvalidArgsException and TagPolicyException (both present in the real SDK's types/errors.go) are not wired to any code path -- no tag-policy engine or "invalid args" condition distinct from the other mapped errors exists in gopherstack to trigger them from.
  • RequestCertificate does not accept the ManagedBy input field (CLOUDFRONT); see ManagedBy gap above.
  • AcmeAccount is never populated (DescribeAcmeAccount/ListAcmeAccounts/RevokeAcmeAccount always operate on an empty account set). Real ACME accounts are created by an ACME client's own RFC 8555 "newAccount" protocol call against the endpoint's EndpointUrl -- a real ACME protocol front-end (parsing/serving actual ACME JSON, JWS-signed requests, nonce challenges, etc.) is out of scope for this rollout per the task's explicit instruction that real cryptographic ACME protocol work is not required. The three ops are wired against real (honestly empty) backend state and validate their AcmeEndpointArn FK for real -- this is a deliberate scope boundary, not an unwired stub. Deferred: an actual ACME protocol server that populates this table.
  • AcmeDomainValidation.Status never leaves VALIDATING (real values also include VALID/INVALID/DELETING). gopherstack has no DNS resolver to check the synthesized prevalidation ResourceRecord against, so it never claims a validation succeeded or failed -- doing so would be exactly the "claim a domain validation succeeded when nothing validated it" fabrication the task explicitly called out to avoid. FailureDetails is consequently always absent too (nothing to report a failure for). Deferred: real DNS-record verification (would require gopherstack's embedded DNS server, pkgs/dns, to actually serve/check the record).
  • SearchCertificates' X509AttributeFilter.Subject (full Distinguished Name filtering: CommonName/Country/Organization/etc.) is not supported -- gopherstack's Certificate.Subject is stored only as the pkix.Name.String() rendering from crypto.go, not structured RDN components, so there is nothing to filter sub-fields of without re-parsing that string (low value, not attempted this pass).
  • AcmCertificateMetadataFilter's AcmeAccountId/AcmeEndpointArn/ManagedBy/CertificateKeyPairOrigin members (and the matching SearchCertificates SortBy values) never match/sort meaningfully: Certificate carries no such fields (CertificateDetail.AcmeAccountId/AcmeEndpointArn are new real-SDK fields this pass did NOT wire onto RequestCertificate/DescribeCertificate/CertificateSummary, since no ACME-issued-certificate code path exists to populate them from -- see the AcmeAccount gap above; ManagedBy is the pre-existing gap from the prior pass). Correct-by-absence, not fabricated.
Deferred
  • AMAZON_ISSUED export gating via Options.Export=ENABLED (2025 exportable-public-certificates feature) — see gaps
  • ManagedBy (CloudFront-managed certificates) end-to-end
  • HTTP validation method / HttpRedirect
  • A real ACME protocol front-end (RFC 8555 server) that would let AcmeAccount, and CertificateDetail's new AcmeAccountId/AcmeEndpointArn fields, actually get populated
  • AcmeDomainValidation real DNS-record verification (VALID/INVALID transitions)
  • …and 1 more — see PARITY.md

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrCertNotFound      = errors.New("ResourceNotFoundException")
	ErrInvalidParameter  = errors.New("ValidationException")
	ErrNotEligible       = errors.New("RequestInProgressException")
	ErrRequestInProgress = errors.New("RequestInProgressException")
	ErrAlreadyRevoked    = errors.New("InvalidStateException")
	ErrInvalidState      = errors.New("InvalidStateException")
	ErrResourceInUse     = errors.New("ResourceInUseException")
	ErrConflict          = errors.New("ConflictException")
	// ErrInvalidArn is returned when a CertificateArn does not match the
	// expected ACM ARN shape (arn:<partition>:acm:<region>:<account>:certificate/<id>).
	// Real AWS returns InvalidArnException for malformed ARNs, distinct from
	// ResourceNotFoundException (well-formed ARN, no such resource).
	ErrInvalidArn = errors.New("InvalidArnException")
	// ErrLimitExceeded is returned when an ACM account/resource quota (e.g. the
	// per-certificate domain-name count) is exceeded.
	ErrLimitExceeded = errors.New("LimitExceededException")
	// ErrTooManyTags is returned when a tagging operation would exceed the
	// maximum of 50 tags per certificate.
	ErrTooManyTags = errors.New("TooManyTagsException")
	// ErrInvalidTag is returned when a tag key or value fails AWS tag
	// constraints (e.g. the reserved "aws:" prefix).
	ErrInvalidTag = errors.New("InvalidTagException")
	// ErrInvalidDomainValidationOptions is returned when the
	// DomainValidationOptions input to RequestCertificate references a domain
	// not in the request, or specifies a ValidationDomain that is not the
	// same as or a superdomain of its DomainName.
	ErrInvalidDomainValidationOptions = errors.New("InvalidDomainValidationOptionsException")

	// ErrAcmeResourceNotFound is returned when an ACME endpoint, external
	// account binding, ACME account, or domain validation referenced by ARN
	// (or, for accounts, by AccountUrl) does not exist. It maps to the same
	// ResourceNotFoundException code as ErrCertNotFound but is kept as a
	// distinct identity so acme_*.go call sites read clearly and do not imply
	// a certificate was involved.
	ErrAcmeResourceNotFound = errors.New("ResourceNotFoundException")
)

Functions

This section is empty.

Types

type AccountConfig 

type AccountConfig struct {
	DaysBeforeExpiry int32 `json:"daysBeforeExpiry"`
}

AccountConfig holds account-level ACM configuration.

type AcmeAccount added in v1.2.0 

type AcmeAccount struct {
	CreatedAt                     time.Time `json:"createdAt"`
	AccountURL                    string    `json:"accountUrl"`
	Region                        string    `json:"region"`
	AcmeEndpointArn               string    `json:"acmeEndpointArn"`
	AcmeExternalAccountBindingArn string    `json:"acmeExternalAccountBindingArn,omitempty"`
	PublicKeyThumbprint           string    `json:"publicKeyThumbprint,omitempty"`
	Status                        string    `json:"status"`
	Contacts                      []string  `json:"contacts,omitempty"`
}

AcmeAccount is an ACME account registered with an endpoint. Real ACME accounts are created by an ACME client's own "newAccount" protocol call against the endpoint's EndpointUrl (RFC 8555 section 7.3) -- a real ACME protocol server is explicitly out of scope for this rollout (see CLAUDE.md's parity principles: no fabricated verified state). gopherstack therefore never populates this table itself; DescribeAcmeAccount/ ListAcmeAccounts/RevokeAcmeAccount are wired against real (honestly empty) backend state and validate their AcmeEndpointArn foreign key for real, but will only ever operate over accounts that do not exist until a real ACME protocol front-end is added -- see PARITY.md's gaps entry for this family. Owned by exactly one AcmeEndpoint, cascade-deleted with it.

type AcmeDomainValidation added in v1.2.0 

type AcmeDomainValidation struct {
	CreatedAt         time.Time       `json:"createdAt"`
	UpdatedAt         time.Time       `json:"updatedAt"`
	ResourceRecord    *ResourceRecord `json:"resourceRecord,omitempty"`
	ARN               string          `json:"arn"`
	Region            string          `json:"region"`
	AcmeEndpointArn   string          `json:"acmeEndpointArn"`
	DomainName        string          `json:"domainName"`
	Status            string          `json:"status"`
	PrevalidationType string          `json:"prevalidationType"`
	DomainScopeExact  string          `json:"domainScopeExact,omitempty"`
	DomainScopeSub    string          `json:"domainScopeSub,omitempty"`
	DomainScopeWild   string          `json:"domainScopeWild,omitempty"`
	HostedZoneID      string          `json:"hostedZoneId,omitempty"`
	IdempotencyToken  string          `json:"idempotencyToken,omitempty"`
}

AcmeDomainValidation authorizes an ACME endpoint to issue certificates for a domain name via DNS prevalidation. Owned by exactly one AcmeEndpoint (AcmeEndpointArn), cascade-deleted with it -- see DeleteAcmeEndpoint in acme_endpoints.go.

Status is always VALIDATING: gopherstack has no real DNS resolver to check the synthesized ResourceRecord against, so it never claims VALID (a verification that never actually happened) or INVALID. This mirrors the task's explicit instruction not to fabricate a validated state -- see PARITY.md's gaps entry for this family.

type AcmeEndpoint added in v1.2.0 

type AcmeEndpoint struct {
	CreatedAt             time.Time    `json:"createdAt"`
	UpdatedAt             time.Time    `json:"updatedAt"`
	ARN                   string       `json:"arn"`
	Region                string       `json:"region"`
	AuthorizationBehavior string       `json:"authorizationBehavior"`
	Contact               string       `json:"contact,omitempty"`
	EndpointURL           string       `json:"endpointUrl"`
	Status                string       `json:"status"`
	FailureReason         string       `json:"failureReason,omitempty"`
	IdempotencyToken      string       `json:"idempotencyToken,omitempty"`
	AllowedKeyAlgorithms  []string     `json:"allowedKeyAlgorithms,omitempty"`
	CertificateTags       []svcTags.KV `json:"certificateTags,omitempty"`
}

AcmeEndpoint is a managed ACME server (RFC 8555) endpoint. It is the root of the ACME resource family: external account bindings (acme_eab.go), ACME accounts (acme_accounts.go), and domain validations (acme_domain_validations.go) all belong to exactly one endpoint and are cascade-deleted with it -- see DeleteAcmeEndpoint below.

type AcmeExternalAccountBinding added in v1.2.0 

type AcmeExternalAccountBinding struct {
	CreatedAt       time.Time  `json:"createdAt"`
	UpdatedAt       time.Time  `json:"updatedAt"`
	ExpiresAt       *time.Time `json:"expiresAt,omitempty"`
	LastUsedAt      *time.Time `json:"lastUsedAt,omitempty"`
	RevokedAt       *time.Time `json:"revokedAt,omitempty"`
	ARN             string     `json:"arn"`
	Region          string     `json:"region"`
	AcmeEndpointArn string     `json:"acmeEndpointArn"`
	RoleArn         string     `json:"roleArn"`
	// KeyID/MacKey are the synthetic ACME EAB credentials returned by
	// GetAcmeExternalAccountBindingCredentials. Real cryptographic ACME
	// protocol participation is out of scope (see CLAUDE.md parity
	// principles); these are deterministic, per-EAB random values -- not
	// values ACM ever validates a real ACME client's request against, so
	// nothing downstream treats them as cryptographically meaningful.
	KeyID            string `json:"keyId"`
	MacKey           string `json:"macKey"`
	IdempotencyToken string `json:"idempotencyToken,omitempty"`
}

AcmeExternalAccountBinding (EAB) authorizes an ACME client to register an account with an endpoint, scoped to a single IAM role. Owned by exactly one AcmeEndpoint (AcmeEndpointArn), cascade-deleted with it -- see DeleteAcmeEndpoint in acme_endpoints.go.

type Certificate 

type Certificate struct {
	CreatedAt        time.Time       `json:"createdAt"`
	NotBefore        time.Time       `json:"notBefore"`
	NotAfter         time.Time       `json:"notAfter"`
	RevokedAt        *time.Time      `json:"revokedAt,omitempty"`
	IssuedAt         *time.Time      `json:"issuedAt,omitempty"`
	ImportedAt       *time.Time      `json:"importedAt,omitempty"`
	RenewalSummary   *RenewalSummary `json:"renewalSummary,omitempty"`
	CertificateBody  string          `json:"certificateBody,omitempty"`
	IdempotencyToken string          `json:"idempotencyToken,omitempty"`
	Subject          string          `json:"subject,omitempty"`
	Issuer           string          `json:"issuer,omitempty"`
	// SubjectCommonName/IssuerCommonName are the CommonName (CN) RDN component
	// parsed/generated separately from the flattened Subject/Issuer strings
	// above. Real AWS's X509Attributes.Subject/Issuer are structured
	// DistinguishedName objects whose CommonName member is just the CN, e.g.
	// "example.com" -- not the whole rendered DN
	// ("CN=example.com,OU=...,O=...,C=US") that Subject/Issuer hold here for
	// display. See crypto.go and SearchCertificates' Subject filter (CommonName
	// is the only member the real SubjectFilter union defines).
	SubjectCommonName                  string `json:"subjectCommonName,omitempty"`
	IssuerCommonName                   string `json:"issuerCommonName,omitempty"`
	KeyAlgorithm                       string `json:"keyAlgorithm,omitempty"`
	SignatureAlgorithm                 string `json:"signatureAlgorithm,omitempty"`
	Status                             string `json:"status"`
	Type                               string `json:"type"`
	RevocationReason                   string `json:"revocationReason,omitempty"`
	DomainName                         string `json:"domainName"`
	ValidationMethod                   string `json:"validationMethod,omitempty"`
	RenewalEligibility                 string `json:"renewalEligibility,omitempty"`
	CertificateChain                   string `json:"certificateChain,omitempty"`
	Serial                             string `json:"serial,omitempty"`
	CertificateTransparencyLoggingPref string `json:"certTransparencyLoggingPref,omitempty"`
	PrivateKey                         string `json:"privateKey,omitempty"`
	CertificateAuthorityArn            string `json:"certificateAuthorityArn,omitempty"`
	KeyID                              string `json:"keyId,omitempty"`
	ExportPref                         string `json:"exportPref,omitempty"`
	FailureReason                      string `json:"failureReason,omitempty"`

	ARN                     string                   `json:"arn"`
	ManagedBy               string                   `json:"managedBy,omitempty"`
	InUseBy                 []string                 `json:"inUseBy,omitempty"`
	KeyUsage                []string                 `json:"keyUsage,omitempty"`
	ExtendedKeyUsage        []string                 `json:"extendedKeyUsage,omitempty"`
	SubjectAlternativeNames []string                 `json:"subjectAlternativeNames,omitempty"`
	DomainValidationOptions []DomainValidationOption `json:"domainValidationOptions,omitempty"`
	Exported                bool                     `json:"exported,omitempty"`
	// contains filtered or unexported fields
}

Certificate represents an ACM certificate.

type CreateAcmeDomainValidationParams added in v1.2.0 

type CreateAcmeDomainValidationParams struct {
	AcmeEndpointArn  string
	DomainName       string
	IdempotencyToken string
	DNSPrevalidation *DNSPrevalidationParams
	Tags             []svcTags.KV
}

CreateAcmeDomainValidationParams holds the parsed CreateAcmeDomainValidation input.

type CreateAcmeEABParams added in v1.2.0 

type CreateAcmeEABParams struct {
	AcmeEndpointArn  string
	RoleArn          string
	IdempotencyToken string
	ExpirationType   string
	Tags             []svcTags.KV
	ExpirationValue  int64
}

CreateAcmeEABParams holds the parsed CreateAcmeExternalAccountBinding input.

type CreateAcmeEndpointParams added in v1.2.0 

type CreateAcmeEndpointParams struct {
	AuthorizationBehavior string
	Contact               string
	IdempotencyToken      string
	AllowedKeyAlgorithms  []string
	CertificateTags       []svcTags.KV
}

CreateAcmeEndpointParams holds the parsed CreateAcmeEndpoint input.

type DNSPrevalidationParams added in v1.2.0 

type DNSPrevalidationParams struct {
	DomainScopeExact string
	DomainScopeSub   string
	DomainScopeWild  string
	HostedZoneID     string
}

DNSPrevalidationParams is the parsed PrevalidationOptions.DnsPrevalidation member -- the only PrevalidationOptions union member the real API defines.

type DomainValidationOption 

type DomainValidationOption struct {
	ResourceRecord   *ResourceRecord `json:"resourceRecord,omitempty"`
	DomainName       string          `json:"domainName"`
	ValidationDomain string          `json:"validationDomain"`
	ValidationStatus string          `json:"validationStatus"`
	ValidationMethod string          `json:"validationMethod"`
	// ValidationEmails is populated when ValidationMethod is EMAIL.
	ValidationEmails []string `json:"validationEmails,omitempty"`
}

DomainValidationOption holds the validation details for a single domain.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the resource ARN from the JSON body -- the certificate ARN for certificate ops, or the equivalent ARN field for the ACME endpoint/EAB/domain-validation/generic-tagging operations.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns supported ACM operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend and restoring the handler's tag state.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM JSON-protocol requests.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the background janitor and all in-flight certificate auto-validation timers so no goroutine outlives the service.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend and also capturing the handler's tag state.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor for idempotency tokens.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM certificates. InMemoryBackend stores ACM state. certs is a single flat store.Table keyed by the composite "region|arn" string (see regionKey) with a companion byRegion Index, replacing the previous map[region]map[arn]*Certificate nesting -- see store_setup.go. The remaining maps are non-*T value maps (their values are plain structs, not pointers) and stay nested by region as plain maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AddInUseBy 

func (b *InMemoryBackend) AddInUseBy(ctx context.Context, certARN, resourceARN string)

AddInUseBy records that a resource ARN is using the certificate. It is a no-op if the certificate does not exist or the ARN is already present.

func (*InMemoryBackend) ApplyDomainValidationOverrides added in v1.2.0 

func (b *InMemoryBackend) ApplyDomainValidationOverrides(
	ctx context.Context, certARN string, overrides map[string]string,
) error

ApplyDomainValidationOverrides applies a RequestCertificate DomainValidationOptions input (already validated by validateDomainValidationOptions) to a just-created certificate, overriding the ValidationDomain -- and, for EMAIL validation, the well-known validation email addresses derived from it -- for each named domain. It is a no-op when overrides is empty.

func (*InMemoryBackend) CertExists 

func (b *InMemoryBackend) CertExists(ctx context.Context, certARN string) bool

CertExists reports whether a certificate with the given ARN exists in the backend. This is used by the handler to validate tag operations.

func (*InMemoryBackend) Close 

func (b *InMemoryBackend) Close()

Close stops all in-flight certificate auto-validation timers so their goroutines do not outlive the backend, without otherwise clearing state. It is safe to call multiple times.

func (*InMemoryBackend) CreateAcmeDomainValidation added in v1.2.0 

func (b *InMemoryBackend) CreateAcmeDomainValidation(
	ctx context.Context, p CreateAcmeDomainValidationParams,
) (*AcmeDomainValidation, error)

CreateAcmeDomainValidation creates a new domain validation under an existing endpoint.

func (*InMemoryBackend) CreateAcmeEndpoint added in v1.2.0 

func (b *InMemoryBackend) CreateAcmeEndpoint(
	ctx context.Context, p CreateAcmeEndpointParams,
) (*AcmeEndpoint, error)

CreateAcmeEndpoint creates a new ACME endpoint. AuthorizationBehavior must be PRE_APPROVED (the only value the real API defines) and a PublicCertificateAuthority (the only CertificateAuthority union member AWS defines) must have been supplied -- both checked by the caller via jsonCreateAcmeEndpoint before AllowedKeyAlgorithms reaches here. Endpoints go ACTIVE synchronously: gopherstack has no async provisioning pipeline to model CREATING against, and a synchronous ACTIVE result never claims a real ACME client interaction (directory fetch, account registration, cert issuance) that did not happen.

func (*InMemoryBackend) CreateAcmeExternalAccountBinding added in v1.2.0 

func (b *InMemoryBackend) CreateAcmeExternalAccountBinding(
	ctx context.Context, p CreateAcmeEABParams,
) (*AcmeExternalAccountBinding, error)

CreateAcmeExternalAccountBinding creates a new EAB under an existing endpoint.

func (*InMemoryBackend) DeleteAcmeDomainValidation added in v1.2.0 

func (b *InMemoryBackend) DeleteAcmeDomainValidation(ctx context.Context, dvARN string) error

DeleteAcmeDomainValidation removes the domain validation with the given ARN.

func (*InMemoryBackend) DeleteAcmeEndpoint added in v1.2.0 

func (b *InMemoryBackend) DeleteAcmeEndpoint(ctx context.Context, epARN string) error

DeleteAcmeEndpoint removes the endpoint and cascade-deletes every external account binding, ACME account, and domain validation that belongs to it -- real AWS ACME endpoints own their EABs/accounts/domain-validations (their ARNs are literally nested under the endpoint's), so leaving them behind as orphans after the parent endpoint disappears would misrepresent gopherstack's own resource-ownership model, not just the real API's.

func (*InMemoryBackend) DeleteAcmeExternalAccountBinding added in v1.2.0 

func (b *InMemoryBackend) DeleteAcmeExternalAccountBinding(ctx context.Context, eabARN string) error

DeleteAcmeExternalAccountBinding removes the EAB with the given ARN.

func (*InMemoryBackend) DeleteCertificate 

func (b *InMemoryBackend) DeleteCertificate(ctx context.Context, certARN string) error

DeleteCertificate removes the certificate with the given ARN.

func (*InMemoryBackend) DescribeAcmeAccount added in v1.2.0 

func (b *InMemoryBackend) DescribeAcmeAccount(ctx context.Context, epARN, accountURL string) (*AcmeAccount, error)

DescribeAcmeAccount looks up an ACME account by endpoint + AccountUrl.

func (*InMemoryBackend) DescribeAcmeDomainValidation added in v1.2.0 

func (b *InMemoryBackend) DescribeAcmeDomainValidation(
	ctx context.Context, dvARN string,
) (*AcmeDomainValidation, error)

DescribeAcmeDomainValidation returns the domain validation with the given ARN.

func (*InMemoryBackend) DescribeAcmeEndpoint added in v1.2.0 

func (b *InMemoryBackend) DescribeAcmeEndpoint(ctx context.Context, epARN string) (*AcmeEndpoint, error)

DescribeAcmeEndpoint returns the endpoint with the given ARN.

func (*InMemoryBackend) DescribeAcmeExternalAccountBinding added in v1.2.0 

func (b *InMemoryBackend) DescribeAcmeExternalAccountBinding(
	ctx context.Context, eabARN string,
) (*AcmeExternalAccountBinding, error)

DescribeAcmeExternalAccountBinding returns the EAB with the given ARN.

func (*InMemoryBackend) DescribeCertificate 

func (b *InMemoryBackend) DescribeCertificate(ctx context.Context, arn string) (*Certificate, error)

DescribeCertificate returns the certificate with the given ARN.

func (*InMemoryBackend) DomainValidationExists added in v1.2.0 

func (b *InMemoryBackend) DomainValidationExists(ctx context.Context, dvARN string) bool

DomainValidationExists reports whether a domain validation with the given ARN exists in the request region. Used by generic resource tagging (handler_resource_tags.go).

func (*InMemoryBackend) EABExists added in v1.2.0 

func (b *InMemoryBackend) EABExists(ctx context.Context, eabARN string) bool

EABExists reports whether an EAB with the given ARN exists in the request region. Used by generic resource tagging (handler_resource_tags.go).

func (*InMemoryBackend) EndpointExists added in v1.2.0 

func (b *InMemoryBackend) EndpointExists(ctx context.Context, epARN string) bool

EndpointExists reports whether an ACME endpoint with the given ARN exists in the request region. Used by sibling families (EAB, domain validation, generic resource tagging) to validate ownership FKs.

func (*InMemoryBackend) ExpireCertificate 

func (b *InMemoryBackend) ExpireCertificate(ctx context.Context, certARN string) error

ExpireCertificate transitions an ISSUED certificate to EXPIRED status. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in ISSUED status.

func (*InMemoryBackend) ExportCertificate 

func (b *InMemoryBackend) ExportCertificate(
	ctx context.Context, certARN string, passphrase []byte,
) (*Certificate, error)

ExportCertificate returns the PEM certificate body, chain, and private key for an eligible certificate -- IMPORTED/PRIVATE unconditionally, AMAZON_ISSUED only when opted in via Options.Export=ENABLED (see validateCertExportable). When the stored certificate has no associated chain, a fake chain (intermediate + root) is returned in PEM format to simulate AWS ACM behaviour. If passphrase is non-nil and non-empty, the private key is returned encrypted using AES-256.

func (*InMemoryBackend) FailCertificate 

func (b *InMemoryBackend) FailCertificate(ctx context.Context, certARN, reason string) error

FailCertificate transitions a PENDING_VALIDATION certificate to FAILED status with the given failure reason. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in PENDING_VALIDATION status.

func (*InMemoryBackend) GetAccountConfiguration 

func (b *InMemoryBackend) GetAccountConfiguration(ctx context.Context) AccountConfig

GetAccountConfiguration returns the account-level ACM configuration for the request region.

func (*InMemoryBackend) GetAcmeExternalAccountBindingCredentials added in v1.2.0 

func (b *InMemoryBackend) GetAcmeExternalAccountBindingCredentials(
	ctx context.Context, eabARN string,
) (string, string, error)

GetAcmeExternalAccountBindingCredentials returns the KeyId/MacKey for an active (non-revoked) EAB.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, certARN string) (string, string, error)

GetCertificate returns the PEM certificate body and chain for any certificate.

func (*InMemoryBackend) ImportCertificate 

func (b *InMemoryBackend) ImportCertificate(
	ctx context.Context,
	certBody, privateKey, certChain, certARNToUpdate string,
) (*Certificate, error)

ImportCertificate stores a PEM-encoded certificate, private key, and optional certificate chain, returning the ARN of the newly created or updated entry. When certARNToUpdate is non-empty, the existing certificate is updated in-place (re-import), matching AWS behavior where CertificateArn may be passed to replace an existing imported certificate.

func (*InMemoryBackend) InactivateCertificate 

func (b *InMemoryBackend) InactivateCertificate(ctx context.Context, certARN string) error

InactivateCertificate transitions an ISSUED certificate to INACTIVE status. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in ISSUED status.

func (*InMemoryBackend) ListAcmeAccounts added in v1.2.0 

func (b *InMemoryBackend) ListAcmeAccounts(
	ctx context.Context, epARN, nextToken string, maxResults int,
) (page.Page[AcmeAccount], error)

ListAcmeAccounts returns a paginated list of ACME accounts registered with epARN.

func (*InMemoryBackend) ListAcmeDomainValidations added in v1.2.0 

func (b *InMemoryBackend) ListAcmeDomainValidations(
	ctx context.Context, epARN, nextToken string, maxResults int,
) (page.Page[AcmeDomainValidation], error)

ListAcmeDomainValidations returns a paginated list of domain validations owned by epARN.

func (*InMemoryBackend) ListAcmeEndpoints added in v1.2.0 

func (b *InMemoryBackend) ListAcmeEndpoints(
	ctx context.Context, nextToken string, maxResults int,
) (page.Page[AcmeEndpoint], error)

ListAcmeEndpoints returns a paginated list of ACME endpoints in the request region, sorted by ARN for stable ordering.

func (*InMemoryBackend) ListAcmeExternalAccountBindings added in v1.2.0 

func (b *InMemoryBackend) ListAcmeExternalAccountBindings(
	ctx context.Context, epARN, nextToken string, maxResults int,
) (page.Page[AcmeExternalAccountBinding], error)

ListAcmeExternalAccountBindings returns a paginated list of EABs owned by epARN.

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context, p ListCertificatesParams,
) (page.Page[Certificate], error)

ListCertificates returns a paginated list of certificates, with optional filtering and sorting.

func (*InMemoryBackend) PutAccountConfiguration 

func (b *InMemoryBackend) PutAccountConfiguration(
	ctx context.Context, idempotencyToken string, daysBeforeExpiry *int32,
) error

PutAccountConfiguration stores the account-level ACM configuration. idempotencyToken must be non-empty; repeated calls with the same token are silently accepted only when the configuration is identical (AWS behavior). A conflicting call with the same token but different settings returns ErrConflict.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RemoveInUseBy 

func (b *InMemoryBackend) RemoveInUseBy(ctx context.Context, certARN, resourceARN string)

RemoveInUseBy removes a resource ARN from the certificate's InUseBy list. It is a no-op if the certificate does not exist or the ARN is not present.

func (*InMemoryBackend) RenewCertificate 

func (b *InMemoryBackend) RenewCertificate(ctx context.Context, certARN string) error

RenewCertificate regenerates the certificate material for an AMAZON_ISSUED certificate, extending its validity by one year. Returns ErrNotEligible for IMPORTED certificates, as AWS ACM does not support renewing imported certificates.

func (*InMemoryBackend) RequestCertificate 

func (b *InMemoryBackend) RequestCertificate(
	ctx context.Context,
	domainName, certType, validationMethod, idempotencyToken, keyAlgorithm, caArn, optionsPref string,
	sans []string,
) (*Certificate, error)

RequestCertificate creates a new certificate for the given domain. When validationMethod is "DNS" or "EMAIL" the certificate starts in PENDING_VALIDATION and automatically transitions to ISSUED after a short delay. idempotencyToken, if non-empty, deduplicates the request — repeated calls with the same token return the previously created certificate ARN.

func (*InMemoryBackend) ResendValidationEmail 

func (b *InMemoryBackend) ResendValidationEmail(ctx context.Context, certARN, domain, validationDomain string) error

ResendValidationEmail re-triggers the EMAIL validation flow for a certificate that is still in PENDING_VALIDATION status with EMAIL validation method.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all certificate state and stops any pending auto-validate timers.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RevokeAcmeAccount added in v1.2.0 

func (b *InMemoryBackend) RevokeAcmeAccount(ctx context.Context, epARN, accountURL string) error

RevokeAcmeAccount revokes an ACME account by endpoint + AccountUrl.

func (*InMemoryBackend) RevokeAcmeExternalAccountBinding added in v1.2.0 

func (b *InMemoryBackend) RevokeAcmeExternalAccountBinding(ctx context.Context, eabARN string) error

RevokeAcmeExternalAccountBinding marks an EAB revoked. Revoking an already-revoked EAB returns ErrInvalidState (InvalidStateException), matching RevokeCertificate's already-revoked handling elsewhere in this package.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, certARN, revocationReason string) error

RevokeCertificate marks the certificate as REVOKED with the given reason. Returns ErrAlreadyRevoked if the certificate is already revoked. Only ISSUED certificates can be revoked; PENDING_VALIDATION certs return ErrInvalidParameter.

func (*InMemoryBackend) RunJanitor 

func (b *InMemoryBackend) RunJanitor(ctx context.Context, interval time.Duration)

RunJanitor periodically cleans up expired idempotency tokens.

func (*InMemoryBackend) SearchCertificates added in v1.2.0 

func (b *InMemoryBackend) SearchCertificates(
	ctx context.Context, p SearchCertificatesParams,
) (page.Page[Certificate], error)

SearchCertificates returns certificates in the request region matching p.Filter (or all of them, if p.Filter is nil), sorted and paginated per p.

func (*InMemoryBackend) SetExportPreference added in v1.2.0 

func (b *InMemoryBackend) SetExportPreference(ctx context.Context, certARN, exportPref string) error

SetExportPreference records a just-created certificate's RequestCertificate Options.Export choice (ENABLED/DISABLED). Real AWS treats Export as immutable once the certificate exists, so this is only ever called once, immediately after RequestCertificate, from jsonRequestCertificate. A blank pref is a no-op (the Certificate's zero value already reads as DISABLED).

func (*InMemoryBackend) SetManagedBy added in v1.2.0 

func (b *InMemoryBackend) SetManagedBy(ctx context.Context, certARN, managedBy string) error

SetManagedBy records a just-created certificate's RequestCertificate ManagedBy choice. The value must already be validated (see validateManagedBy, called before the certificate is created so an invalid value never leaves an orphaned certificate behind -- same reasoning as DomainValidationOptions, see ApplyDomainValidationOverrides). Like SetExportPreference, this is only ever called once, immediately after RequestCertificate, from jsonRequestCertificate. A blank value is a no-op (the Certificate's zero value already reads as caller-managed).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TimeoutPendingValidation 

func (b *InMemoryBackend) TimeoutPendingValidation(ctx context.Context, certARN string) error

TimeoutPendingValidation transitions a PENDING_VALIDATION certificate to VALIDATION_TIMED_OUT. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in PENDING_VALIDATION status.

func (*InMemoryBackend) UpdateAcmeDomainValidation added in v1.2.0 

func (b *InMemoryBackend) UpdateAcmeDomainValidation(
	ctx context.Context, dvARN string, dns *DNSPrevalidationParams,
) error

UpdateAcmeDomainValidation replaces an existing domain validation's prevalidation options (the only field the real API allows updating), regenerating its DNS resource record. Status is left at VALIDATING for the same reason CreateAcmeDomainValidation never sets anything else.

func (*InMemoryBackend) UpdateAcmeEndpoint added in v1.2.0 

func (b *InMemoryBackend) UpdateAcmeEndpoint(
	ctx context.Context, epARN string, p UpdateAcmeEndpointParams,
) error

UpdateAcmeEndpoint applies a partial update to an existing endpoint.

func (*InMemoryBackend) UpdateCertificateOptions 

func (b *InMemoryBackend) UpdateCertificateOptions(ctx context.Context, certARN, transparencyLoggingPref string) error

UpdateCertificateOptions sets the CertificateTransparencyLoggingPreference for a certificate. Only ISSUED certificates may be updated.

type ListCertificatesParams 

type ListCertificatesParams struct {
	NextToken        string
	SortBy           string
	SortOrder        string
	StatusFilter     []string
	KeyTypes         []string
	KeyUsage         []string
	ExtendedKeyUsage []string
	MaxItems         int
}

ListCertificatesParams holds all filter and sorting options for ListCertificates.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RenewalSummary 

type RenewalSummary struct {
	// UpdatedAt is when the renewal summary was last updated. Required
	// (always present) on the real AWS wire.
	UpdatedAt time.Time `json:"updatedAt"`
	// RenewalStatus is the status of the renewal (e.g. PENDING_VALIDATION, SUCCESS).
	RenewalStatus string `json:"RenewalStatus"`
	// RenewalStatusReason is set when RenewalStatus is FAILED, describing why.
	RenewalStatusReason string `json:"renewalStatusReason,omitempty"`
	// DomainValidationOptions contains per-domain validation details for the renewal.
	DomainValidationOptions []DomainValidationOption `json:"DomainValidationOptions,omitempty"`
}

RenewalSummary describes the state of an ACM managed renewal for a certificate.

type ResourceRecord 

type ResourceRecord struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Value string `json:"value"`
}

ResourceRecord holds the CNAME record used for DNS certificate validation.

type SearchCertificatesParams added in v1.2.0 

type SearchCertificatesParams struct {
	Filter     *certFilterStatement
	SortBy     string
	SortOrder  string
	NextToken  string
	MaxResults int
}

SearchCertificatesParams holds the parsed SearchCertificates input.

type UpdateAcmeEndpointParams added in v1.2.0 

type UpdateAcmeEndpointParams struct {
	AuthorizationBehavior *string
	Contact               *string
	AllowedKeyAlgorithms  *[]string
}

UpdateAcmeEndpointParams holds the parsed UpdateAcmeEndpoint input. Every field is optional on the real wire; an empty/nil value means "leave unchanged" (see jsonUpdateAcmeEndpoint, which only sets a field here when the caller's JSON body actually included it).

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.