CertificateAuthority

Source: src/AWS/ACMPCA/CertificateAuthority.ts

An Amazon Web Services Private CA certificate authority.

A newly created CA starts in the PENDING_CERTIFICATE state — to activate it you must retrieve its CSR, sign it (self-sign for a root CA), and import the signed certificate. Private CAs bill a monthly fee for as long as they exist, so destroy test CAs promptly. Deletion places the CA in the DELETED state for a configurable 7-30 day restoration window.

Creating a Certificate Authority

Root CA

import * as ACMPCA from "alchemy/AWS/ACMPCA";

const ca = yield* ACMPCA.CertificateAuthority("RootCA", {
  subject: { commonName: "corp.example.com" },
});

ECDSA Subordinate CA

const ca = yield* ACMPCA.CertificateAuthority("IssuingCA", {
  type: "SUBORDINATE",
  keyAlgorithm: "EC_prime256v1",
  signingAlgorithm: "SHA256WITHECDSA",
  subject: {
    commonName: "issuing.corp.example.com",
    organization: "Example Corp",
    country: "US",
  },
});

Short-Lived Certificate Mode

const ca = yield* ACMPCA.CertificateAuthority("ShortLivedCA", {
  subject: { commonName: "ephemeral.example.com" },
  usageMode: "SHORT_LIVED_CERTIFICATE",
});

Revocation

const ca = yield* ACMPCA.CertificateAuthority("RootCA", {
  subject: { commonName: "corp.example.com" },
  revocationConfiguration: {
    crlConfiguration: {
      enabled: true,
      expiration: "7 days",
      s3BucketName: bucket.bucketName,
    },
  },
});

Granting ACM Access

const permission = yield* ACMPCA.Permission("AcmRenewal", {
  certificateAuthorityArn: ca.certificateAuthorityArn,
});

Reacting to CA Events

// ACM PCA emits lifecycle events (certificate issuance, expiry, CRL and
// audit-report generation) on the default EventBridge bus under the
// `aws.acm-pca` source — consume them with the generic EventBridge
// event source; there is no ACM PCA-specific notification config.
yield* AWS.EventBridge.consumeBusEvents(
  {
    source: ["aws.acm-pca"],
    "detail-type": ["ACM Private CA Certificate Issuance"],
  },
  (events) =>
    Stream.runForEach(events, (event) => Effect.log(event.detail)),
);