TrustAnchor

Source: src/AWS/RolesAnywhere/TrustAnchor.ts

An IAM Roles Anywhere trust anchor. A trust anchor establishes trust between IAM Roles Anywhere and your certificate authority (CA) — either an uploaded PEM CA certificate bundle or a reference to an AWS Private CA. Workloads outside AWS authenticate with certificates issued by the CA in exchange for temporary AWS credentials.

Creating a Trust Anchor

Certificate Bundle Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
});

AWS Private CA Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  acmPcaArn: privateCa.certificateAuthorityArn,
});

Disabling a Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
  enabled: false,
});

Expiry Notifications

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
  notificationSettings: [
    { event: "CA_CERTIFICATE_EXPIRY", threshold: "30 days" },
  ],
});