Use audit reports with your private CA

To create an audit report (console)

1. Sign in to your Amazon account and open the Amazon Private CA console at https://console.amazonaws.cn/acm-pca/home.

2. On the Private certificate authories page, choose your private CA from the list.

3. From the Actions menu, choose Generate audit report.

4. Under Audit report destination, for Create a new S3 bucket?, choose Yes and type a unique bucket name, or choose No and choose an existing bucket from the list.

   If you choose Yes, Amazon Private CA creates and attaches the default policy to your bucket. The default policy includes an aws:SourceAccount condition key, which limits access to a specific Amazon account. If you wish to further constrain access, you can add other condition keys to the policy such as in the preceding example.

   If you choose No, you must attach a policy to your bucket before you can generate an audit report. Use the policy pattern described in Prepare an Amazon S3 bucket for audit reports. For information about attaching a policy, see Adding a bucket policy using the Amazon S3 console.

5. Under Output format, choose JSON for JavaScript Object Notation or CSV for comma-separated values.

6. Choose Generate audit report.

To create an audit report (Amazon CLI)

1. If you do not already have an S3 bucket to use, create one.

2. Attach a policy to your bucket. Use the policy pattern described in Prepare an Amazon S3 bucket for audit reports. For information about attaching a policy, see Adding a bucket policy using the Amazon S3 console

3. Use the create-certificate-authority-audit-report command to create the audit report and to place it in the prepared S3 bucket.

   $ aws acm-pca create-certificate-authority-audit-report \
   --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566 \
   --s3-bucket-name amzn-s3-demo-bucket \
   --audit-report-response-format JSON 

To configure automatic encryption

Complete the following steps to enable S3 server-side encryption.

1. Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the Buckets table, choose the bucket that will hold your Amazon Private CA assets.

3. On the page for your bucket, choose the Properties tab.

4. Choose the Default encryption card.

5. Choose Enable.

6. Choose Amazon S3 key (SSE-S3).

7. Choose Save Changes.

To configure custom encryption

Complete the following steps to enable encryption using a custom key.

1. Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the Buckets table, choose the bucket that will hold your Amazon Private CA assets.

3. On the page for your bucket, choose the Properties tab.

4. Choose the Default encryption card.

5. Choose Enable.

6. Choose Amazon Key Management Service key (SSE-KMS).

7. Choose either Choose from your Amazon KMS keys or Enter Amazon KMS key ARN.

8. Choose Save Changes.

9. (Optional) If you do not have an KMS key already, create one using the following Amazon CLI create-key command:

   $ aws kms create-key

   The output contains the key ID and Amazon Resource Name (ARN) of the KMS key. The following is an example output:

   {
       "KeyMetadata": {
           "KeyId": "01234567-89ab-cdef-0123-456789abcdef",
           "Description": "",
           "Enabled": true,
           "KeyUsage": "ENCRYPT_DECRYPT",
           "KeyState": "Enabled",
           "CreationDate": 1478910250.94,
           "Arn": "arn:aws:kms:us-west-2:123456789012:key/01234567-89ab-cdef-0123-456789abcdef",
           "AWSAccountId": "123456789012"
       }
   }

10. Using the following steps, you give the Amazon Private CA service principal permission to use the KMS key. By default, all KMS keys are private; only the resource owner can use a KMS key to encrypt and decrypt data. However, the resource owner can grant permissions to access the KMS key to other users and resources. The service principal must be in the same Region as where the KMS key is stored.

    1. First, save the default policy for your KMS key as policy.json using the following get-key-policy command:

       $ aws kms get-key-policy --key-id key-id --policy-name default --output text > ./policy.json

    2. Open the policy.json file in a text editor. Select one of the following policy statements and add it to the existing policy.

       If your Amazon S3 bucket key is enabled, use the following statement:

       {
          "Sid":"Allow ACM-PCA use of the key",
          "Effect":"Allow",
          "Principal":{
             "Service":"acm-pca.amazonaws.com"
          },
          "Action":[
             "kms:GenerateDataKey",
             "kms:Decrypt"
          ],
          "Resource":"*",
          "Condition":{
             "StringLike":{
                "kms:EncryptionContext:aws:s3:arn":"arn:aws:s3:::bucket-name"
             }
          }
       }

       If your Amazon S3 bucket key is disabled, use the following statement:

       {
          "Sid":"Allow ACM-PCA use of the key",
          "Effect":"Allow",
          "Principal":{
             "Service":"acm-pca.amazonaws.com"
          },
          "Action":[
             "kms:GenerateDataKey",
             "kms:Decrypt"
          ],
          "Resource":"*",
          "Condition":{
             "StringLike":{
                "kms:EncryptionContext:aws:s3:arn":[
                   "arn:aws:s3:::bucket-name/acm-pca-permission-test-key",
                   "arn:aws:s3:::bucket-name/acm-pca-permission-test-key-private",
                   "arn:aws:s3:::bucket-name/audit-report/*",
                   "arn:aws:s3:::bucket-name/crl/*"
                ]
             }
          }
       }

    3. Finally, apply the updated policy using the following put-key-policy command:

       $ aws kms put-key-policy --key-id key_id --policy-name default --policy file://policy.json