acmpca

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 36 Imported by: 0

README

ACM PCA

Parity grade: A · SDK aws-sdk-go-v2/service/acmpca@v1.50.0 · last audited 2026-10-10 (2332c3128)

Coverage

Metric Value
PARITY entries audited 23 (23 ok)
Known gaps none
Structural gaps (can't be emulated) 1
Deferred items 0
Resource leaks clean
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • CertificateAuthorityStatus FAILED and CertificateAuthority.FailureReason: CA creation is synchronous and generates keys locally, so no request times out and no algorithm is rejected after acceptance.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrCANotFound is returned when a Certificate Authority is not found.
	ErrCANotFound = errors.New("ResourceNotFoundException")
	// ErrCertNotFound is returned when an issued certificate is not found.
	ErrCertNotFound = errors.New("ResourceNotFoundException")
	// ErrInvalidArgs is returned when an operation argument fails validation.
	// acm-pca's own deserializeOpError models InvalidArgsException, not the
	// fabricated InvalidParameterException gopherstack previously emitted
	// (gopherstack-r3pr): see aws-sdk-go-v2/service/acmpca deserializers.go,
	// e.g. awsAwsjson11_deserializeOpErrorCreateCertificateAuthority.
	ErrInvalidArgs = errors.New("InvalidArgsException")
	// ErrInvalidArn is returned when a CA/certificate/resource ARN fails
	// validation or lookup, matching InvalidArnException (modeled by nearly
	// every acm-pca operation's deserializeOpError).
	ErrInvalidArn = errors.New("InvalidArnException")
	// ErrInvalidRequest is returned when the request action cannot be
	// performed or is prohibited, matching InvalidRequestException
	// (RevokeCertificate, ImportCertificateAuthorityCertificate).
	ErrInvalidRequest = errors.New("InvalidRequestException")
	// ErrInvalidPolicy is returned when a resource policy is invalid or
	// missing a required statement, matching InvalidPolicyException
	// (PutPolicy).
	ErrInvalidPolicy = errors.New("InvalidPolicyException")
	// ErrMalformedCertificate is returned when an imported certificate fails
	// to decode/parse, matching MalformedCertificateException
	// (ImportCertificateAuthorityCertificate).
	ErrMalformedCertificate = errors.New("MalformedCertificateException")
	// ErrMalformedCSR is returned when a certificate signing request fails
	// to decode/parse, matching MalformedCSRException (IssueCertificate).
	ErrMalformedCSR = errors.New("MalformedCSRException")
	// ErrInvalidNextToken is returned for a malformed pagination token
	// (ListCertificateAuthorities, ListPermissions).
	ErrInvalidNextToken = errors.New("InvalidNextTokenException")
	// ErrInvalidState is returned when the CA is in an invalid state for the operation.
	ErrInvalidState = errors.New("InvalidStateException")
	// ErrPermissionNotFound is returned when a CA permission is not found.
	ErrPermissionNotFound = errors.New("ResourceNotFoundException")
	// ErrPermissionAlreadyExists is returned when a permission for the same
	// principal/source-account pair already exists on the CA.
	ErrPermissionAlreadyExists = errors.New("PermissionAlreadyExistsException")
	// ErrPolicyNotFound is returned when a CA policy is not found.
	ErrPolicyNotFound = errors.New("ResourceNotFoundException")
	// ErrAuditReportNotFound is returned when a CA audit report is not found.
	ErrAuditReportNotFound = errors.New("ResourceNotFoundException")
	// ErrTooManyTags is returned when tagging a CA would exceed the 50-tag limit.
	ErrTooManyTags = errors.New("TooManyTagsException")
	// ErrRequestAlreadyProcessed is returned when RevokeCertificate is called
	// on a certificate that is already revoked, matching
	// RequestAlreadyProcessedException ("Your request has already been
	// completed") -- modeled only by RevokeCertificate's own deserializeOpError
	// (acmpca@v1.50.0 deserializers.go), not by any other operation in this
	// service.
	ErrRequestAlreadyProcessed = errors.New("RequestAlreadyProcessedException")
)

Functions

This section is empty.

Types

type APIPassthrough added in v1.2.0 

type APIPassthrough struct {
	Subject    *APIPassthroughSubject
	Extensions *APIPassthroughExtensions
}

APIPassthrough mirrors aws-sdk-go-v2 types.APIPassthrough: the subject and X.509 extension overrides IssueCertificate applies when the request's TemplateArn selects an APIPassthrough/APICSRPassthrough template variant (see decodeAPIPassthrough in handler_certificates.go for that gating).

type APIPassthroughCustomAttribute 

type APIPassthroughCustomAttribute struct {
	ObjectIdentifier string
	Value            string
}

APIPassthroughCustomAttribute mirrors aws-sdk-go-v2 types.CustomAttribute: an arbitrary X.500 relative distinguished name identified by OID.

type APIPassthroughCustomExtension added in v1.2.0 

type APIPassthroughCustomExtension struct {
	ObjectIdentifier string
	ValueBase64      string
	Critical         bool
}

APIPassthroughCustomExtension mirrors aws-sdk-go-v2 types.CustomExtension: an arbitrary X.509 extension identified by OID, carrying an already-DER-encoded value the caller supplies verbatim (base64 on the wire).

type APIPassthroughEdiPartyName 

type APIPassthroughEdiPartyName struct {
	PartyName    string
	NameAssigner string
}

APIPassthroughEdiPartyName mirrors aws-sdk-go-v2 types.EdiPartyName (EDIPartyName ::= SEQUENCE { nameAssigner [0] DirectoryString OPTIONAL, partyName [1] DirectoryString }, RFC 5280 §4.2.1.6). Both fields are EXPLICITly tagged: DirectoryString is itself a CHOICE, and X.680 forbids IMPLICIT tagging of a CHOICE type even under this module's default IMPLICIT tagging environment.

type APIPassthroughExtendedKeyUsage added in v1.2.0 

type APIPassthroughExtendedKeyUsage struct {
	Type             string
	ObjectIdentifier string
}

APIPassthroughExtendedKeyUsage mirrors aws-sdk-go-v2 types.ExtendedKeyUsage: exactly one of Type (a standard ExtendedKeyUsageType) or ObjectIdentifier (a custom OID) is set.

type APIPassthroughExtensions added in v1.2.0 

type APIPassthroughExtensions struct {
	KeyUsage                *APIPassthroughKeyUsage
	CertificatePolicies     []APIPassthroughPolicyInformation
	ExtendedKeyUsage        []APIPassthroughExtendedKeyUsage
	SubjectAlternativeNames []APIPassthroughSAN
	CustomExtensions        []APIPassthroughCustomExtension
}

APIPassthroughExtensions mirrors aws-sdk-go-v2 types.Extensions.

type APIPassthroughKeyUsage added in v1.2.0 

type APIPassthroughKeyUsage struct {
	DigitalSignature bool
	NonRepudiation   bool
	KeyEncipherment  bool
	DataEncipherment bool
	KeyAgreement     bool
	KeyCertSign      bool
	CRLSign          bool
	EncipherOnly     bool
	DecipherOnly     bool
}

APIPassthroughKeyUsage mirrors aws-sdk-go-v2 types.KeyUsage.

type APIPassthroughOtherName 

type APIPassthroughOtherName struct {
	TypeID string
	Value  string
}

APIPassthroughOtherName mirrors aws-sdk-go-v2 types.OtherName: an arbitrary-OID GeneralName variant (OtherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY DEFINED BY type-id }, RFC 5280 §4.2.1.6). Neither the SDK doc comment nor RFC 5280 fixes an ASN.1 type for the type-id-defined value; gopherstack encodes it as a UTF8String -- a design choice, not a verified SDK/RFC fact.

type APIPassthroughPolicyInformation 

type APIPassthroughPolicyInformation struct {
	CertPolicyID string
	Qualifiers   []APIPassthroughPolicyQualifier
}

APIPassthroughPolicyInformation mirrors aws-sdk-go-v2 types.PolicyInformation: the X.509 certificatePolicies extension (RFC 5280 §4.2.1.4, OID 2.5.29.32).

type APIPassthroughPolicyQualifier 

type APIPassthroughPolicyQualifier struct {
	CPSURI string
}

APIPassthroughPolicyQualifier mirrors aws-sdk-go-v2 types.Qualifier. Amazon Web Services Private CA supports only the certification practice statement (CPS) qualifier -- types.PolicyQualifierId's only enum value is "CPS" (verified via acmpca/types/enums.go).

type APIPassthroughSAN added in v1.2.0 

type APIPassthroughSAN struct {
	OtherName                 *APIPassthroughOtherName
	DirectoryName             *APIPassthroughSubject
	EdiPartyName              *APIPassthroughEdiPartyName
	DNSName                   string
	IPAddress                 string
	EmailAddress              string
	UniformResourceIdentifier string
	RegisteredID              string
}

APIPassthroughSAN mirrors aws-sdk-go-v2 types.GeneralName: exactly one field is set per RFC 5280's GeneralName CHOICE (enforced by decodeGeneralName in handler_certificates.go, which also enforces the SDK's documented "Providing more than one option results in an InvalidArgsException" rule). DnsName/IpAddress/Rfc822Name/ UniformResourceIdentifier map directly to x509.Certificate's standard SAN fields when no exotic variant is present in the same request; OtherName, DirectoryName, EdiPartyName, and RegisteredId require a hand-built subjectAltName extension -- see applySubjectAlternativeNames in crypto.go.

type APIPassthroughSubject added in v1.2.0 

type APIPassthroughSubject struct {
	CommonName                 string
	Country                    string
	Organization               string
	OrganizationalUnit         string
	State                      string
	Locality                   string
	SerialNumber               string
	DistinguishedNameQualifier string
	GenerationQualifier        string
	GivenName                  string
	Initials                   string
	Pseudonym                  string
	Surname                    string
	Title                      string
	CustomAttributes           []APIPassthroughCustomAttribute
}

APIPassthroughSubject overrides the CSR-derived certificate subject with explicit X.500 attributes, mirroring every field of aws-sdk-go-v2 types.ASN1Subject. The exotic RDN types (DistinguishedNameQualifier, GenerationQualifier, GivenName, Initials, Pseudonym, Surname, Title, CustomAttributes) are carried through pkix.Name.ExtraNames -- see apiPassthroughSubjectToPKIX in crypto.go -- using the RFC 5280 Appendix A.1 / RFC 4519 OIDs (pseudonym 2.5.4.65, generationQualifier 2.5.4.44, dnQualifier 2.5.4.46, title 2.5.4.12, initials 2.5.4.43, givenName 2.5.4.42, surname 2.5.4.4).

type AccessDescription 

type AccessDescription struct {
	AccessMethodType       string            `json:"AccessMethodType,omitempty"`
	CustomObjectIdentifier string            `json:"CustomObjectIdentifier,omitempty"`
	AccessLocation         APIPassthroughSAN `json:"AccessLocation"`
}

AccessDescription mirrors aws-sdk-go-v2 types.AccessDescription; exactly one of AccessMethodType and CustomObjectIdentifier is set.

type AuditReport 

type AuditReport struct {
	CreatedAt               time.Time `json:"createdAt"`
	AuditReportID           string    `json:"auditReportId"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	S3BucketName            string    `json:"s3BucketName"`
	S3Key                   string    `json:"s3Key"`
	Status                  string    `json:"status"`
	// contains filtered or unexported fields
}

AuditReport represents an ACM PCA audit report generated for a certificate authority.

type CertificateAuthority 

type CertificateAuthority struct {
	CreatedAt time.Time `json:"createdAt"`
	NotBefore time.Time `json:"notBefore"`
	NotAfter  time.Time `json:"notAfter"`
	// RestorableUntil is the end of the restoration window while the CA is
	// DELETED (see DeleteCertificateAuthority); zero once the CA is not DELETED.
	RestorableUntil time.Time `json:"restorableUntil"`
	// LastStateChangeAt is updated on every operation that changes Status or
	// the CA's certificate material (Create, Import, self-sign-activate,
	// Update, Delete, Restore), mirroring types.CertificateAuthority's
	// LastStateChangeAt field.
	LastStateChangeAt time.Time `json:"lastStateChangeAt"`

	// RevocationConfiguration holds the CRL/OCSP settings accepted by
	// CreateCertificateAuthority/UpdateCertificateAuthority; nil means "not
	// configured" (DescribeCertificateAuthority omits the field entirely, as
	// the real SDK does for a nil *types.RevocationConfiguration).
	RevocationConfiguration *RevocationConfiguration `json:"revocationConfiguration,omitempty"`
	ARN                     string                   `json:"arn"`
	OwnerAccount            string                   `json:"ownerAccount"`
	Type                    string                   `json:"type"`
	Status                  string                   `json:"status"`
	// KeyStorageSecurityStandard mirrors types.KeyStorageSecurityStandard;
	// defaults to FIPS_140_2_LEVEL_3_OR_HIGHER, matching the real API's default.
	KeyStorageSecurityStandard string `json:"keyStorageSecurityStandard,omitempty"`
	// UsageMode mirrors types.CertificateAuthorityUsageMode; defaults to
	// GENERAL_PURPOSE. When SHORT_LIVED_CERTIFICATE, IssueCertificate enforces
	// the real API's 7-day validity cap for certificates issued by this CA.
	UsageMode        string `json:"usageMode,omitempty"`
	Serial           string `json:"serial,omitempty"`
	CertificateBody  string `json:"certificateBody,omitempty"`
	CertificateChain string `json:"certificateChain,omitempty"`
	CSR              string `json:"csr,omitempty"`

	CertificateAuthorityConfiguration CertificateAuthorityConfiguration `json:"certificateAuthorityConfiguration"`
	// contains filtered or unexported fields
}

CertificateAuthority represents an ACM PCA Certificate Authority.

type CertificateAuthorityConfiguration 

type CertificateAuthorityConfiguration struct {
	CsrExtensions    *CsrExtensions              `json:"CsrExtensions,omitempty"`
	KeyAlgorithm     string                      `json:"KeyAlgorithm"`
	SigningAlgorithm string                      `json:"SigningAlgorithm"`
	Subject          CertificateAuthoritySubject `json:"Subject"`
}

CertificateAuthorityConfiguration holds the configuration for a Certificate Authority.

type CertificateAuthoritySubject 

type CertificateAuthoritySubject struct {
	CommonName                 string                          `json:"CommonName,omitempty"`
	Country                    string                          `json:"Country,omitempty"`
	Organization               string                          `json:"Organization,omitempty"`
	OrganizationalUnit         string                          `json:"OrganizationalUnit,omitempty"`
	State                      string                          `json:"State,omitempty"`
	Locality                   string                          `json:"Locality,omitempty"`
	SerialNumber               string                          `json:"SerialNumber,omitempty"`
	DistinguishedNameQualifier string                          `json:"DistinguishedNameQualifier,omitempty"`
	GenerationQualifier        string                          `json:"GenerationQualifier,omitempty"`
	GivenName                  string                          `json:"GivenName,omitempty"`
	Initials                   string                          `json:"Initials,omitempty"`
	Pseudonym                  string                          `json:"Pseudonym,omitempty"`
	Surname                    string                          `json:"Surname,omitempty"`
	Title                      string                          `json:"Title,omitempty"`
	CustomAttributes           []APIPassthroughCustomAttribute `json:"CustomAttributes,omitempty"`
}

CertificateAuthoritySubject holds the subject fields for a Certificate Authority.

type CreateCAOption added in v1.2.0 

type CreateCAOption func(*createCAOptions)

CreateCAOption customizes CreateCertificateAuthority. See WithCreateCA* below.

func WithCreateCAIdempotencyToken added in v1.2.0 

func WithCreateCAIdempotencyToken(token string) CreateCAOption

WithCreateCAIdempotencyToken deduplicates repeated CreateCertificateAuthority calls bearing the same token within a 5-minute window: the original CA's ARN is returned instead of creating a duplicate.

func WithCreateCAKeyStorageSecurityStandard added in v1.2.0 

func WithCreateCAKeyStorageSecurityStandard(std string) CreateCAOption

WithCreateCAKeyStorageSecurityStandard sets KeyStorageSecurityStandard.

func WithCreateCARevocationConfiguration added in v1.2.0 

func WithCreateCARevocationConfiguration(rc *RevocationConfiguration) CreateCAOption

WithCreateCARevocationConfiguration sets the CA's initial CRL/OCSP configuration.

func WithCreateCAUsageMode added in v1.2.0 

func WithCreateCAUsageMode(mode string) CreateCAOption

WithCreateCAUsageMode sets UsageMode (GENERAL_PURPOSE or SHORT_LIVED_CERTIFICATE).

type CrlConfiguration added in v1.2.0 

type CrlConfiguration struct {
	CustomCname      string `json:"customCname,omitempty"`
	CustomPath       string `json:"customPath,omitempty"`
	S3BucketName     string `json:"s3BucketName,omitempty"`
	S3ObjectACL      string `json:"s3ObjectAcl,omitempty"`
	CrlType          string `json:"crlType,omitempty"`
	ExpirationInDays int32  `json:"expirationInDays,omitempty"`
	Enabled          bool   `json:"enabled"`
	OmitExtension    bool   `json:"omitExtension,omitempty"`
}

CrlConfiguration mirrors aws-sdk-go-v2 types.CrlConfiguration: certificate revocation list settings for a CA. CrlDistributionPointExtensionConfiguration is flattened into OmitExtension (its only field).

type CsrExtensions 

type CsrExtensions struct {
	KeyUsage                 *APIPassthroughKeyUsage `json:"KeyUsage,omitempty"`
	SubjectInformationAccess []AccessDescription     `json:"SubjectInformationAccess,omitempty"`
}

CsrExtensions mirrors aws-sdk-go-v2 types.CsrExtensions.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM PCA operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM PCA handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM PCA instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM PCA action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the primary ARN from the JSON body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported ACM PCA operations.

func (*Handler) GetTagsForTest 

func (h *Handler) GetTagsForTest(resourceID string) []map[string]string

GetTagsForTest is a test helper that returns all tags for a resource by ARN.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM PCA JSON-protocol requests.

func (*Handler) SetTagsForTest 

func (h *Handler) SetTagsForTest(resourceID string, kv map[string]string)

SetTagsForTest is a test helper that sets tags for a resource by ARN.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM PCA resources.

The CA/certificate/permission/audit-report collections below were previously nested by region (outer key = region, e.g. map[string]map[string]*CertificateAuthority) so that same-ARN-shaped resources in different regions were fully isolated. Phase 3.3 of the datalayer refactor replaces each of those with a flat *store.Table, keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping certs/permissions by (region, CA ARN) for the CA-scoped list operations -- the same region-qualified-table pattern services/emr/services/neptune/services/mwaa use. certsByCASerial (a derived, rebuilt-on-Restore lookup of bare strings with no identity of their own) and policies (a bare string value with no identity struct) are deliberately NOT converted to store.Table: store.Table requires a *V value with its own identity, which neither has; they remain plain region-nested maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) CreateCertificateAuthority 

func (b *InMemoryBackend) CreateCertificateAuthority(
	ctx context.Context,
	caType string,
	cfg CertificateAuthorityConfiguration,
	opts ...CreateCAOption,
) (*CertificateAuthority, error)

CreateCertificateAuthority creates a new Certificate Authority.

func (*InMemoryBackend) CreateCertificateAuthorityAuditReport 

func (b *InMemoryBackend) CreateCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	s3BucketName string,
	responseFormat string,
) (*AuditReport, error)

CreateCertificateAuthorityAuditReport creates a new audit report for the given CA.

func (*InMemoryBackend) CreatePermission 

func (b *InMemoryBackend) CreatePermission(
	ctx context.Context,
	caARN string,
	principal string,
	sourceAccount string,
	actions []string,
) (*Permission, error)

CreatePermission creates a permission on the given CA.

func (*InMemoryBackend) DeleteCertificateAuthority 

func (b *InMemoryBackend) DeleteCertificateAuthority(
	ctx context.Context, caARN string, permanentDeletionDays int32,
) error

DeleteCertificateAuthority marks the CA as DELETED.

func (*InMemoryBackend) DeletePermission 

func (b *InMemoryBackend) DeletePermission(ctx context.Context, caARN, principal, sourceAccount string) error

DeletePermission deletes a permission on the given CA.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(ctx context.Context, caARN string) error

DeletePolicy deletes the resource policy for the given CA.

func (*InMemoryBackend) DescribeCertificateAuthority 

func (b *InMemoryBackend) DescribeCertificateAuthority(
	ctx context.Context, caARN string,
) (*CertificateAuthority, error)

DescribeCertificateAuthority returns the CA with the given ARN.

func (*InMemoryBackend) DescribeCertificateAuthorityAuditReport 

func (b *InMemoryBackend) DescribeCertificateAuthorityAuditReport(
	ctx context.Context,
	caARN string,
	auditReportID string,
) (*AuditReport, error)

DescribeCertificateAuthorityAuditReport returns the audit report for the given CA.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, caARN, certARN string) (*IssuedCertificate, error)

GetCertificate returns the certificate for the given CA and certificate ARN. It validates that the certificate belongs to the specified CA.

func (*InMemoryBackend) GetCertificateAuthorityCertificate 

func (b *InMemoryBackend) GetCertificateAuthorityCertificate(
	ctx context.Context, caARN string,
) (string, string, error)

GetCertificateAuthorityCertificate returns the certificate body and chain PEM for the given CA.

func (*InMemoryBackend) GetCertificateAuthorityCsr 

func (b *InMemoryBackend) GetCertificateAuthorityCsr(ctx context.Context, caARN string) (string, error)

GetCertificateAuthorityCsr returns the CSR PEM for the given CA.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(ctx context.Context, caARN string) (string, error)

GetPolicy returns the resource policy for the given CA.

func (*InMemoryBackend) ImportCertificateAuthorityCertificate 

func (b *InMemoryBackend) ImportCertificateAuthorityCertificate(
	ctx context.Context, caARN, certPEM, chainPEM string,
) error

ImportCertificateAuthorityCertificate imports a signed certificate for the CA, activating it. It parses the certificate to extract NotBefore/NotAfter and stores the optional chain.

func (*InMemoryBackend) IssueCertificate 

func (b *InMemoryBackend) IssueCertificate(
	ctx context.Context, caARN, csrPEM string, validityDays int, opts ...IssueCertOption,
) (*IssuedCertificate, error)

IssueCertificate issues a new certificate signed by the given CA.

func (*InMemoryBackend) ListCertificateAuthorities 

func (b *InMemoryBackend) ListCertificateAuthorities(
	ctx context.Context, nextToken string, maxItems int, resourceOwner string,
) (page.Page[CertificateAuthority], error)

ListCertificateAuthorities returns a paginated list of CAs sorted by ARN. resourceOwner mirrors ListCertificateAuthoritiesInput.ResourceOwner: SELF (or empty, the real API's default) lists CAs owned by this account; OTHER_ACCOUNTS always returns an empty page, since gopherstack does not model cross-account CA sharing (no CA here is ever owned by another account -- see PARITY.md).

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context,
	caARN string,
	nextToken string,
	maxItems int,
) page.Page[IssuedCertificate]

ListCertificates returns a paginated list of certificates issued by the given CA.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	ctx context.Context, caARN, nextToken string, maxItems int,
) (page.Page[Permission], error)

ListPermissions lists permissions on the given CA.

func (*InMemoryBackend) PutPolicy 

func (b *InMemoryBackend) PutPolicy(ctx context.Context, caARN, policy string) error

PutPolicy stores a resource policy on the given CA.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificateAuthority 

func (b *InMemoryBackend) RestoreCertificateAuthority(ctx context.Context, caARN string) error

RestoreCertificateAuthority restores a deleted CA into the DISABLED state.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, caARN, serial, revocationReason string) error

RevokeCertificate revokes the given certificate using the O(1) serial index.

func (*InMemoryBackend) SetAuditReportDelay 

func (b *InMemoryBackend) SetAuditReportDelay(d time.Duration)

SetAuditReportDelay keeps new audit reports in CREATING for d (default 0: immediately SUCCESS).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateCertificateAuthority 

func (b *InMemoryBackend) UpdateCertificateAuthority(
	ctx context.Context, caARN, status string, opts ...UpdateCAOption,
) error

UpdateCertificateAuthority updates the CA status and/or revocation configuration.

type IssueCertOption added in v1.2.0 

type IssueCertOption func(*issueCertOptions)

IssueCertOption customizes IssueCertificate. See WithIssueCert* below.

func WithIssueCertAPIPassthrough added in v1.2.0 

func WithIssueCertAPIPassthrough(ap *APIPassthrough) IssueCertOption

WithIssueCertAPIPassthrough applies custom subject/extension overrides, honored only when the request's TemplateArn selects an APIPassthrough/ APICSRPassthrough template variant (see resolveTemplateArn).

func WithIssueCertIdempotencyToken added in v1.2.0 

func WithIssueCertIdempotencyToken(token string) IssueCertOption

WithIssueCertIdempotencyToken deduplicates repeated IssueCertificate calls bearing the same token within a 5-minute window: the original certificate's ARN is returned instead of issuing a duplicate.

func WithIssueCertTemplateArn added in v1.2.0 

func WithIssueCertTemplateArn(templateArn string) IssueCertOption

WithIssueCertTemplateArn selects a certificate template: its per-family fixed X.509 extension profile (KeyUsage/ExtendedKeyUsage/BasicConstraints) and APIPassthrough/CSRPassthrough gating -- see resolveTemplateArn.

func WithIssueCertValidityNotBefore added in v1.2.0 

func WithIssueCertValidityNotBefore(notBefore time.Time) IssueCertOption

WithIssueCertValidityNotBefore overrides the certificate's "Not Before" date (default: issuance time).

type IssuedCertificate 

type IssuedCertificate struct {
	IssuedAt         time.Time  `json:"issuedAt"`
	NotBefore        time.Time  `json:"notBefore"`
	NotAfter         time.Time  `json:"notAfter"`
	RevokedAt        *time.Time `json:"revokedAt,omitempty"`
	ARN              string     `json:"arn"`
	CAARN            string     `json:"caArn"`
	Status           string     `json:"status"`
	Serial           string     `json:"serial"`
	CertBody         string     `json:"certBody"`
	RevocationReason string     `json:"revocationReason,omitempty"`
	// contains filtered or unexported fields
}

IssuedCertificate represents a certificate issued by an ACM PCA Certificate Authority.

type OcspConfiguration added in v1.2.0 

type OcspConfiguration struct {
	OcspCustomCname string `json:"ocspCustomCname,omitempty"`
	Enabled         bool   `json:"enabled"`
}

OcspConfiguration mirrors aws-sdk-go-v2 types.OcspConfiguration: Online Certificate Status Protocol settings for a CA.

type Permission 

type Permission struct {
	CreatedAt               time.Time `json:"createdAt"`
	CertificateAuthorityArn string    `json:"certificateAuthorityArn"`
	Policy                  string    `json:"policy,omitempty"`
	Principal               string    `json:"principal"`
	SourceAccount           string    `json:"sourceAccount,omitempty"`

	Actions []string `json:"actions"`
	// contains filtered or unexported fields
}

Permission represents an ACM PCA permission granted on a certificate authority.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM PCA.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM PCA service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RevocationConfiguration added in v1.2.0 

type RevocationConfiguration struct {
	CrlConfiguration  *CrlConfiguration  `json:"crlConfiguration,omitempty"`
	OcspConfiguration *OcspConfiguration `json:"ocspConfiguration,omitempty"`
}

RevocationConfiguration mirrors aws-sdk-go-v2 types.RevocationConfiguration: the combined CRL/OCSP configuration reported by DescribeCertificateAuthority and accepted by CreateCertificateAuthority/UpdateCertificateAuthority.

type UpdateCAOption added in v1.2.0 

type UpdateCAOption func(*updateCAOptions)

UpdateCAOption customizes UpdateCertificateAuthority. See WithUpdateCA* below.

func WithUpdateCARevocationConfiguration added in v1.2.0 

func WithUpdateCARevocationConfiguration(rc *RevocationConfiguration) UpdateCAOption

WithUpdateCARevocationConfiguration replaces the CA's CRL/OCSP configuration. Per the real API, omitting this option entirely (the zero-value default) leaves the CA's existing RevocationConfiguration unchanged; passing rc (even nil, meaning "clear it") always overwrites it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.