CertificateAuthorityPolicy

Source: src/AWS/ACMPCA/CertificateAuthorityPolicy.ts

A resource-based policy attached to a private CA, granting cross-account access — e.g. allowing a Certificate Manager (ACM) user in another account to issue and renew certificates signed by this CA. This is the policy Amazon Web Services Resource Access Manager (RAM) manages when a CA is shared; attach it directly for fine-grained control.

Attaching a CA Policy

import * as ACMPCA from "alchemy/AWS/ACMPCA";

const policy = yield* ACMPCA.CertificateAuthorityPolicy("CrossAccount", {
  certificateAuthorityArn: ca.certificateAuthorityArn,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::123456789012:root" },
        Action: [
          "acm-pca:DescribeCertificateAuthority",
          "acm-pca:GetCertificate",
          "acm-pca:GetCertificateAuthorityCertificate",
          "acm-pca:ListPermissions",
          "acm-pca:IssueCertificate",
          "acm-pca:RevokeCertificate",
        ],
        Resource: ca.certificateAuthorityArn,
      },
    ],
  },
});