AWS SDK for PHP 3.x

Client: Aws\PcaConnectorAd\PcaConnectorAdClient

Service ID: pca-connector-ad

Version: 2018-05-10

This page describes the parameters and results for the operations of the PcaConnectorAd (2018-05-10), and shows how to use the Aws\PcaConnectorAd\PcaConnectorAdClient object to call the described operations. This documentation is specific to the 2018-05-10 API version of the service.

Operation Summary

Each of the following operations can be created from a client using $client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

CreateConnector ( array $params = [] ): Creates a connector between Amazon Web Services Private CA and an Active Directory.
CreateDirectoryRegistration ( array $params = [] ): Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory
CreateServicePrincipalName ( array $params = [] ): Creates a service principal name (SPN) for the service account in Active Directory.
CreateTemplate ( array $params = [] ): Creates an Active Directory compatible certificate template.
CreateTemplateGroupAccessControlEntry ( array $params = [] ): Create a group access control entry.
DeleteConnector ( array $params = [] ): Deletes a connector for Active Directory.
DeleteDirectoryRegistration ( array $params = [] ): Deletes a directory registration.
DeleteServicePrincipalName ( array $params = [] ): Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.
DeleteTemplate ( array $params = [] ): Deletes a template.
DeleteTemplateGroupAccessControlEntry ( array $params = [] ): Deletes a group access control entry.
GetConnector ( array $params = [] ): Lists information about your connector.
GetDirectoryRegistration ( array $params = [] ): A structure that contains information about your directory registration.
GetServicePrincipalName ( array $params = [] ): Lists the service principal name that the connector uses to authenticate with Active Directory.
GetTemplate ( array $params = [] ): Retrieves a certificate template that the connector uses to issue certificates from a private CA.
GetTemplateGroupAccessControlEntry ( array $params = [] ): Retrieves the group access control entries for a template.
ListConnectors ( array $params = [] ): Lists the connectors that you created by using the https://docs.
ListDirectoryRegistrations ( array $params = [] ): Lists the directory registrations that you created by using the https://docs.
ListServicePrincipalNames ( array $params = [] ): Lists the service principal names that the connector uses to authenticate with Active Directory.
ListTagsForResource ( array $params = [] ): Lists the tags, if any, that are associated with your resource.
ListTemplateGroupAccessControlEntries ( array $params = [] ): Lists group access control entries you created.
ListTemplates ( array $params = [] ): Lists the templates, if any, that are associated with a connector.
TagResource ( array $params = [] ): Adds one or more tags to your resource.
UntagResource ( array $params = [] ): Removes one or more tags from your resource.
UpdateTemplate ( array $params = [] ): Update template configuration to define the information included in certificates.
UpdateTemplateGroupAccessControlEntry ( array $params = [] ): Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListConnectors
ListDirectoryRegistrations
ListServicePrincipalNames
ListTemplateGroupAccessControlEntries
ListTemplates

Operations

CreateConnector

$result = $client->createConnector([/* ... */]);
$promise = $client->createConnectorAsync([/* ... */]);

Creates a connector between Amazon Web Services Private CA and an Active Directory. You must specify the private CA, directory ID, and security groups.

Parameter Syntax

$result = $client->createConnector([
    'CertificateAuthorityArn' => '<string>', // REQUIRED
    'ClientToken' => '<string>',
    'DirectoryId' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
    'VpcInformation' => [ // REQUIRED
        'SecurityGroupIds' => ['<string>', ...], // REQUIRED
    ],
]);

Parameter Details

Members

CertificateAuthorityArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

ClientToken

Type: string

Idempotency token.

DirectoryId

Required: Yes
Type: string

The identifier of the Active Directory.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a connector consisting of a key-value pair.

VpcInformation

Required: Yes
Type: VpcInformation structure

Security group IDs that describe the inbound and outbound rules.

Result Syntax

[
    'ConnectorArn' => '<string>',
]

Result Details

Members

ConnectorArn

Type: string

If successful, the Amazon Resource Name (ARN) of the connector for Active Directory.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:
Request would cause a service quota to be exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateDirectoryRegistration

$result = $client->createDirectoryRegistration([/* ... */]);
$promise = $client->createDirectoryRegistrationAsync([/* ... */]);

Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory

Parameter Syntax

$result = $client->createDirectoryRegistration([
    'ClientToken' => '<string>',
    'DirectoryId' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Members

ClientToken

Type: string

Idempotency token.

DirectoryId

Required: Yes
Type: string

The identifier of the Active Directory.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[
    'DirectoryRegistrationArn' => '<string>',
]

Result Details

Members

DirectoryRegistrationArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateServicePrincipalName

$result = $client->createServicePrincipalName([/* ... */]);
$promise = $client->createServicePrincipalNameAsync([/* ... */]);

Creates a service principal name (SPN) for the service account in Active Directory. Kerberos authentication uses SPNs to associate a service instance with a service sign-in account.

Parameter Syntax

$result = $client->createServicePrincipalName([
    'ClientToken' => '<string>',
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ClientToken

Type: string

Idempotency token.

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplate

$result = $client->createTemplate([/* ... */]);
$promise = $client->createTemplateAsync([/* ... */]);

Creates an Active Directory compatible certificate template. The connectors issues certificates using these templates based on the requester’s Active Directory group membership.

Parameter Syntax

$result = $client->createTemplate([
    'ClientToken' => '<string>',
    'ConnectorArn' => '<string>', // REQUIRED
    'Definition' => [ // REQUIRED
        'TemplateV2' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'PrivateKeyAttributes' => [ // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV3' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [ // REQUIRED
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV4' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512',
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'RequireSameKeyRenewal' => true || false,
                'StrongKeyProtectionRequired' => true || false,
                'UseLegacyProvider' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
    ],
    'Name' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Members

ClientToken

Type: string

Idempotency token.

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Definition

Required: Yes
Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Name

Required: Yes
Type: string

Name of the template. The template name must be unique.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a template consisting of a key-value pair.

Result Syntax

[
    'TemplateArn' => '<string>',
]

Result Details

Members

TemplateArn

Type: string

If successful, the Amazon Resource Name (ARN) of the template.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:
Request would cause a service quota to be exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplateGroupAccessControlEntry

$result = $client->createTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->createTemplateGroupAccessControlEntryAsync([/* ... */]);

Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).

Parameter Syntax

$result = $client->createTemplateGroupAccessControlEntry([
    'AccessRights' => [ // REQUIRED
        'AutoEnroll' => 'ALLOW|DENY',
        'Enroll' => 'ALLOW|DENY',
    ],
    'ClientToken' => '<string>',
    'GroupDisplayName' => '<string>', // REQUIRED
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

AccessRights

Required: Yes
Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

ClientToken

Type: string

Idempotency token.

GroupDisplayName

Required: Yes
Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Required: Yes
Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
ServiceQuotaExceededException:
Request would cause a service quota to be exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteConnector

$result = $client->deleteConnector([/* ... */]);
$promise = $client->deleteConnectorAsync([/* ... */]);

Deletes a connector for Active Directory. You must provide the Amazon Resource Name (ARN) of the connector that you want to delete. You can find the ARN by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_ListConnectors action. Deleting a connector does not deregister your directory with Amazon Web Services Private CA. You can deregister your directory by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_DeleteDirectoryRegistration action.

Parameter Syntax

$result = $client->deleteConnector([
    'ConnectorArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteDirectoryRegistration

$result = $client->deleteDirectoryRegistration([/* ... */]);
$promise = $client->deleteDirectoryRegistrationAsync([/* ... */]);

Deletes a directory registration. Deleting a directory registration deauthorizes Amazon Web Services Private CA with the directory.

Parameter Syntax

$result = $client->deleteDirectoryRegistration([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteServicePrincipalName

$result = $client->deleteServicePrincipalName([/* ... */]);
$promise = $client->deleteServicePrincipalNameAsync([/* ... */]);

Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.

Parameter Syntax

$result = $client->deleteServicePrincipalName([
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplate

$result = $client->deleteTemplate([/* ... */]);
$promise = $client->deleteTemplateAsync([/* ... */]);

Deletes a template. Certificates issued using the template are still valid until they are revoked or expired.

Parameter Syntax

$result = $client->deleteTemplate([
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplateGroupAccessControlEntry

$result = $client->deleteTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->deleteTemplateGroupAccessControlEntryAsync([/* ... */]);

Deletes a group access control entry.

Parameter Syntax

$result = $client->deleteTemplateGroupAccessControlEntry([
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

GroupSecurityIdentifier

Required: Yes
Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

GetConnector

$result = $client->getConnector([/* ... */]);
$promise = $client->getConnectorAsync([/* ... */]);

Lists information about your connector. You specify the connector on input by its ARN (Amazon Resource Name).

Parameter Syntax

$result = $client->getConnector([
    'ConnectorArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[
    'Connector' => [
        'Arn' => '<string>',
        'CertificateAuthorityArn' => '<string>',
        'CertificateEnrollmentPolicyServerEndpoint' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryId' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND',
        'UpdatedAt' => <DateTime>,
        'VpcInformation' => [
            'SecurityGroupIds' => ['<string>', ...],
        ],
    ],
]

Result Details

Members

Connector

Type: Connector structure

A structure that contains information about your connector.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

GetDirectoryRegistration

$result = $client->getDirectoryRegistration([/* ... */]);
$promise = $client->getDirectoryRegistrationAsync([/* ... */]);

A structure that contains information about your directory registration.

Parameter Syntax

$result = $client->getDirectoryRegistration([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[
    'DirectoryRegistration' => [
        'Arn' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryId' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

DirectoryRegistration

Type: DirectoryRegistration structure

The directory registration represents the authorization of the connector service with a directory.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

GetServicePrincipalName

$result = $client->getServicePrincipalName([/* ... */]);
$promise = $client->getServicePrincipalNameAsync([/* ... */]);

Lists the service principal name that the connector uses to authenticate with Active Directory.

Parameter Syntax

$result = $client->getServicePrincipalName([
    'ConnectorArn' => '<string>', // REQUIRED
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Result Syntax

[
    'ServicePrincipalName' => [
        'ConnectorArn' => '<string>',
        'CreatedAt' => <DateTime>,
        'DirectoryRegistrationArn' => '<string>',
        'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
        'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|INTERNAL_FAILURE',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

ServicePrincipalName

Type: ServicePrincipalName structure

The service principal name that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplate

$result = $client->getTemplate([/* ... */]);
$promise = $client->getTemplateAsync([/* ... */]);

Retrieves a certificate template that the connector uses to issue certificates from a private CA.

Parameter Syntax

$result = $client->getTemplate([
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'Template' => [
        'Arn' => '<string>',
        'ConnectorArn' => '<string>',
        'CreatedAt' => <DateTime>,
        'Definition' => [
            'TemplateV2' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'PrivateKeyAttributes' => [
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
            'TemplateV3' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                'PrivateKeyAttributes' => [
                    'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'KeyUsageProperty' => [
                        'PropertyFlags' => [
                            'Decrypt' => true || false,
                            'KeyAgreement' => true || false,
                            'Sign' => true || false,
                        ],
                        'PropertyType' => 'ALL',
                    ],
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'RequireAlternateSignatureAlgorithm' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
            'TemplateV4' => [
                'CertificateValidity' => [
                    'RenewalPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                    'ValidityPeriod' => [
                        'Period' => <integer>,
                        'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                    ],
                ],
                'EnrollmentFlags' => [
                    'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                    'IncludeSymmetricAlgorithms' => true || false,
                    'NoSecurityExtension' => true || false,
                    'RemoveInvalidCertificateFromPersonalStore' => true || false,
                    'UserInteractionRequired' => true || false,
                ],
                'Extensions' => [
                    'ApplicationPolicies' => [
                        'Critical' => true || false,
                        'Policies' => [
                            [
                                'PolicyObjectIdentifier' => '<string>',
                                'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                            ],
                            // ...
                        ],
                    ],
                    'KeyUsage' => [
                        'Critical' => true || false,
                        'UsageFlags' => [
                            'DataEncipherment' => true || false,
                            'DigitalSignature' => true || false,
                            'KeyAgreement' => true || false,
                            'KeyEncipherment' => true || false,
                            'NonRepudiation' => true || false,
                        ],
                    ],
                ],
                'GeneralFlags' => [
                    'AutoEnrollment' => true || false,
                    'MachineType' => true || false,
                ],
                'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                'PrivateKeyAttributes' => [
                    'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                    'CryptoProviders' => ['<string>', ...],
                    'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                    'KeyUsageProperty' => [
                        'PropertyFlags' => [
                            'Decrypt' => true || false,
                            'KeyAgreement' => true || false,
                            'Sign' => true || false,
                        ],
                        'PropertyType' => 'ALL',
                    ],
                    'MinimalKeyLength' => <integer>,
                ],
                'PrivateKeyFlags' => [
                    'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                    'ExportableKey' => true || false,
                    'RequireAlternateSignatureAlgorithm' => true || false,
                    'RequireSameKeyRenewal' => true || false,
                    'StrongKeyProtectionRequired' => true || false,
                    'UseLegacyProvider' => true || false,
                ],
                'SubjectNameFlags' => [
                    'RequireCommonName' => true || false,
                    'RequireDirectoryPath' => true || false,
                    'RequireDnsAsCn' => true || false,
                    'RequireEmail' => true || false,
                    'SanRequireDirectoryGuid' => true || false,
                    'SanRequireDns' => true || false,
                    'SanRequireDomainDns' => true || false,
                    'SanRequireEmail' => true || false,
                    'SanRequireSpn' => true || false,
                    'SanRequireUpn' => true || false,
                ],
                'SupersededTemplates' => ['<string>', ...],
            ],
        ],
        'Name' => '<string>',
        'ObjectIdentifier' => '<string>',
        'PolicySchema' => <integer>,
        'Revision' => [
            'MajorRevision' => <integer>,
            'MinorRevision' => <integer>,
        ],
        'Status' => 'ACTIVE|DELETING',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

Template

Type: Template structure

A certificate template that the connector uses to issue certificates from a private CA.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplateGroupAccessControlEntry

$result = $client->getTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->getTemplateGroupAccessControlEntryAsync([/* ... */]);

Retrieves the group access control entries for a template.

Parameter Syntax

$result = $client->getTemplateGroupAccessControlEntry([
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

GroupSecurityIdentifier

Required: Yes
Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'AccessControlEntry' => [
        'AccessRights' => [
            'AutoEnroll' => 'ALLOW|DENY',
            'Enroll' => 'ALLOW|DENY',
        ],
        'CreatedAt' => <DateTime>,
        'GroupDisplayName' => '<string>',
        'GroupSecurityIdentifier' => '<string>',
        'TemplateArn' => '<string>',
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Members

AccessControlEntry

Type: AccessControlEntry structure

An access control entry allows or denies an Active Directory group from enrolling and/or autoenrolling with a template.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListConnectors

$result = $client->listConnectors([/* ... */]);
$promise = $client->listConnectorsAsync([/* ... */]);

Lists the connectors that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateConnector action.

Parameter Syntax

$result = $client->listConnectors([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

MaxResults

Type: int

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Type: string

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[
    'Connectors' => [
        [
            'Arn' => '<string>',
            'CertificateAuthorityArn' => '<string>',
            'CertificateEnrollmentPolicyServerEndpoint' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryId' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND',
            'UpdatedAt' => <DateTime>,
            'VpcInformation' => [
                'SecurityGroupIds' => ['<string>', ...],
            ],
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

Connectors

Type: Array of ConnectorSummary structures

Summary information about each connector you have created.

NextToken

Type: string

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListDirectoryRegistrations

$result = $client->listDirectoryRegistrations([/* ... */]);
$promise = $client->listDirectoryRegistrationsAsync([/* ... */]);

Lists the directory registrations that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateDirectoryRegistration action.

Parameter Syntax

$result = $client->listDirectoryRegistrations([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

MaxResults

Type: int

NextToken

Type: string

Result Syntax

[
    'DirectoryRegistrations' => [
        [
            'Arn' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryId' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

DirectoryRegistrations

Type: Array of DirectoryRegistrationSummary structures

Summary information about each directory registration you have created.

NextToken

Type: string

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListServicePrincipalNames

$result = $client->listServicePrincipalNames([/* ... */]);
$promise = $client->listServicePrincipalNamesAsync([/* ... */]);

Lists the service principal names that the connector uses to authenticate with Active Directory.

Parameter Syntax

$result = $client->listServicePrincipalNames([
    'DirectoryRegistrationArn' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

MaxResults

Type: int

NextToken

Type: string

Result Syntax

[
    'NextToken' => '<string>',
    'ServicePrincipalNames' => [
        [
            'ConnectorArn' => '<string>',
            'CreatedAt' => <DateTime>,
            'DirectoryRegistrationArn' => '<string>',
            'Status' => 'CREATING|ACTIVE|DELETING|FAILED',
            'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|INTERNAL_FAILURE',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Members

NextToken

Type: string

ServicePrincipalNames

Type: Array of ServicePrincipalNameSummary structures

The service principal name, if any, that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Lists the tags, if any, that are associated with your resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'ResourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

ResourceArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Result Syntax

[
    'Tags' => ['<string>', ...],
]

Result Details

Members

Tags

Type: Associative array of custom strings keys (String) to strings

The tags, if any, that are associated with your resource.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplateGroupAccessControlEntries

$result = $client->listTemplateGroupAccessControlEntries([/* ... */]);
$promise = $client->listTemplateGroupAccessControlEntriesAsync([/* ... */]);

Lists group access control entries you created.

Parameter Syntax

$result = $client->listTemplateGroupAccessControlEntries([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

MaxResults

Type: int

NextToken

Type: string

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[
    'AccessControlEntries' => [
        [
            'AccessRights' => [
                'AutoEnroll' => 'ALLOW|DENY',
                'Enroll' => 'ALLOW|DENY',
            ],
            'CreatedAt' => <DateTime>,
            'GroupDisplayName' => '<string>',
            'GroupSecurityIdentifier' => '<string>',
            'TemplateArn' => '<string>',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Members

AccessControlEntries

Type: Array of AccessControlEntrySummary structures

An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template.

NextToken

Type: string

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplates

$result = $client->listTemplates([/* ... */]);
$promise = $client->listTemplatesAsync([/* ... */]);

Lists the templates, if any, that are associated with a connector.

Parameter Syntax

$result = $client->listTemplates([
    'ConnectorArn' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Members

ConnectorArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

MaxResults

Type: int

NextToken

Type: string

Result Syntax

[
    'NextToken' => '<string>',
    'Templates' => [
        [
            'Arn' => '<string>',
            'ConnectorArn' => '<string>',
            'CreatedAt' => <DateTime>,
            'Definition' => [
                'TemplateV2' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'PrivateKeyAttributes' => [
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
                'TemplateV3' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                    'PrivateKeyAttributes' => [
                        'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'KeyUsageProperty' => [
                            'PropertyFlags' => [
                                'Decrypt' => true || false,
                                'KeyAgreement' => true || false,
                                'Sign' => true || false,
                            ],
                            'PropertyType' => 'ALL',
                        ],
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'RequireAlternateSignatureAlgorithm' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
                'TemplateV4' => [
                    'CertificateValidity' => [
                        'RenewalPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                        'ValidityPeriod' => [
                            'Period' => <integer>,
                            'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS',
                        ],
                    ],
                    'EnrollmentFlags' => [
                        'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                        'IncludeSymmetricAlgorithms' => true || false,
                        'NoSecurityExtension' => true || false,
                        'RemoveInvalidCertificateFromPersonalStore' => true || false,
                        'UserInteractionRequired' => true || false,
                    ],
                    'Extensions' => [
                        'ApplicationPolicies' => [
                            'Critical' => true || false,
                            'Policies' => [
                                [
                                    'PolicyObjectIdentifier' => '<string>',
                                    'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                                ],
                                // ...
                            ],
                        ],
                        'KeyUsage' => [
                            'Critical' => true || false,
                            'UsageFlags' => [
                                'DataEncipherment' => true || false,
                                'DigitalSignature' => true || false,
                                'KeyAgreement' => true || false,
                                'KeyEncipherment' => true || false,
                                'NonRepudiation' => true || false,
                            ],
                        ],
                    ],
                    'GeneralFlags' => [
                        'AutoEnrollment' => true || false,
                        'MachineType' => true || false,
                    ],
                    'HashAlgorithm' => 'SHA256|SHA384|SHA512',
                    'PrivateKeyAttributes' => [
                        'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                        'CryptoProviders' => ['<string>', ...],
                        'KeySpec' => 'KEY_EXCHANGE|SIGNATURE',
                        'KeyUsageProperty' => [
                            'PropertyFlags' => [
                                'Decrypt' => true || false,
                                'KeyAgreement' => true || false,
                                'Sign' => true || false,
                            ],
                            'PropertyType' => 'ALL',
                        ],
                        'MinimalKeyLength' => <integer>,
                    ],
                    'PrivateKeyFlags' => [
                        'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016',
                        'ExportableKey' => true || false,
                        'RequireAlternateSignatureAlgorithm' => true || false,
                        'RequireSameKeyRenewal' => true || false,
                        'StrongKeyProtectionRequired' => true || false,
                        'UseLegacyProvider' => true || false,
                    ],
                    'SubjectNameFlags' => [
                        'RequireCommonName' => true || false,
                        'RequireDirectoryPath' => true || false,
                        'RequireDnsAsCn' => true || false,
                        'RequireEmail' => true || false,
                        'SanRequireDirectoryGuid' => true || false,
                        'SanRequireDns' => true || false,
                        'SanRequireDomainDns' => true || false,
                        'SanRequireEmail' => true || false,
                        'SanRequireSpn' => true || false,
                        'SanRequireUpn' => true || false,
                    ],
                    'SupersededTemplates' => ['<string>', ...],
                ],
            ],
            'Name' => '<string>',
            'ObjectIdentifier' => '<string>',
            'PolicySchema' => <integer>,
            'Revision' => [
                'MajorRevision' => <integer>,
                'MinorRevision' => <integer>,
            ],
            'Status' => 'ACTIVE|DELETING',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Members

NextToken

Type: string

Templates

Type: Array of TemplateSummary structures

Custom configuration templates used when issuing a certificate.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds one or more tags to your resource.

Parameter Syntax

$result = $client->tagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members

ResourceArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Tags

Required: Yes
Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes one or more tags from your resource.

Parameter Syntax

$result = $client->untagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'TagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members

ResourceArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

TagKeys

Required: Yes
Type: Array of strings

Specifies a list of tag keys that you want to remove from the specified resources.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.

UpdateTemplate

$result = $client->updateTemplate([/* ... */]);
$promise = $client->updateTemplateAsync([/* ... */]);

Update template configuration to define the information included in certificates.

Parameter Syntax

$result = $client->updateTemplate([
    'Definition' => [
        'TemplateV2' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'PrivateKeyAttributes' => [ // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV3' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [ // REQUIRED
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'StrongKeyProtectionRequired' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
        'TemplateV4' => [
            'CertificateValidity' => [ // REQUIRED
                'RenewalPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
                'ValidityPeriod' => [ // REQUIRED
                    'Period' => <integer>, // REQUIRED
                    'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED
                ],
            ],
            'EnrollmentFlags' => [ // REQUIRED
                'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false,
                'IncludeSymmetricAlgorithms' => true || false,
                'NoSecurityExtension' => true || false,
                'RemoveInvalidCertificateFromPersonalStore' => true || false,
                'UserInteractionRequired' => true || false,
            ],
            'Extensions' => [ // REQUIRED
                'ApplicationPolicies' => [
                    'Critical' => true || false,
                    'Policies' => [ // REQUIRED
                        [
                            'PolicyObjectIdentifier' => '<string>',
                            'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE',
                        ],
                        // ...
                    ],
                ],
                'KeyUsage' => [ // REQUIRED
                    'Critical' => true || false,
                    'UsageFlags' => [ // REQUIRED
                        'DataEncipherment' => true || false,
                        'DigitalSignature' => true || false,
                        'KeyAgreement' => true || false,
                        'KeyEncipherment' => true || false,
                        'NonRepudiation' => true || false,
                    ],
                ],
            ],
            'GeneralFlags' => [ // REQUIRED
                'AutoEnrollment' => true || false,
                'MachineType' => true || false,
            ],
            'HashAlgorithm' => 'SHA256|SHA384|SHA512',
            'PrivateKeyAttributes' => [ // REQUIRED
                'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521',
                'CryptoProviders' => ['<string>', ...],
                'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED
                'KeyUsageProperty' => [
                    'PropertyFlags' => [
                        'Decrypt' => true || false,
                        'KeyAgreement' => true || false,
                        'Sign' => true || false,
                    ],
                    'PropertyType' => 'ALL',
                ],
                'MinimalKeyLength' => <integer>, // REQUIRED
            ],
            'PrivateKeyFlags' => [ // REQUIRED
                'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED
                'ExportableKey' => true || false,
                'RequireAlternateSignatureAlgorithm' => true || false,
                'RequireSameKeyRenewal' => true || false,
                'StrongKeyProtectionRequired' => true || false,
                'UseLegacyProvider' => true || false,
            ],
            'SubjectNameFlags' => [ // REQUIRED
                'RequireCommonName' => true || false,
                'RequireDirectoryPath' => true || false,
                'RequireDnsAsCn' => true || false,
                'RequireEmail' => true || false,
                'SanRequireDirectoryGuid' => true || false,
                'SanRequireDns' => true || false,
                'SanRequireDomainDns' => true || false,
                'SanRequireEmail' => true || false,
                'SanRequireSpn' => true || false,
                'SanRequireUpn' => true || false,
            ],
            'SupersededTemplates' => ['<string>', ...],
        ],
    ],
    'ReenrollAllCertificateHolders' => true || false,
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

Definition

Type: TemplateDefinition structure

ReenrollAllCertificateHolders

Type: boolean

This setting allows the major version of a template to be increased automatically. All members of Active Directory groups that are allowed to enroll with a template will receive a new certificate issued using that template.

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

UpdateTemplateGroupAccessControlEntry

$result = $client->updateTemplateGroupAccessControlEntry([/* ... */]);
$promise = $client->updateTemplateGroupAccessControlEntryAsync([/* ... */]);

Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Parameter Syntax

$result = $client->updateTemplateGroupAccessControlEntry([
    'AccessRights' => [
        'AutoEnroll' => 'ALLOW|DENY',
        'Enroll' => 'ALLOW|DENY',
    ],
    'GroupDisplayName' => '<string>',
    'GroupSecurityIdentifier' => '<string>', // REQUIRED
    'TemplateArn' => '<string>', // REQUIRED
]);

Parameter Details

Members

AccessRights

Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

GroupDisplayName

Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Required: Yes
Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes
Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:
You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.
ValidationException:
An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.
ResourceNotFoundException:
The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.
ThrottlingException:
The limit on the number of requests per second was exceeded.
InternalServerException:
The request processing has failed because of an unknown error, exception or failure with an internal server.
ConflictException:
This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Shapes

AccessControlEntry

Description

An access control entry allows or denies Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autoenrolling with the template.

Members

AccessRights

Type: AccessRights structure

Permissions to allow or deny an Active Directory group to enroll or autoenroll certificates issued against a template.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessControlEntrySummary

Description

Summary of group access control entries that allow or deny Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autofenrolling with the template.

Members

AccessRights

Type: AccessRights structure

Allow or deny an Active Directory group from enrolling and autoenrolling certificates issued against a template.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessDeniedException

Description

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

Members

Message

Required: Yes
Type: string

AccessRights

Description

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

Members

AutoEnroll

Type: string

Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment

Enroll

Type: string

Allow or deny an Active Directory group from enrolling certificates issued against a template.

ApplicationPolicies

Description

Application policies describe what the certificate can be used for.

Members

Critical

Type: boolean

Marks the application policy extension as critical.

Policies

Required: Yes
Type: Array of ApplicationPolicy structures

Application policies describe what the certificate can be used for.

ApplicationPolicy

Description

Application policies describe what the certificate can be used for.

Members

PolicyObjectIdentifier

Type: string

The object identifier (OID) of an application policy.

PolicyType

Type: string

The type of application policy

CertificateValidity

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

RenewalPeriod

Required: Yes
Type: ValidityPeriod structure

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

ValidityPeriod

Required: Yes
Type: ValidityPeriod structure

ConflictException

Description

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Members

Message

Required: Yes
Type: string

ResourceId

Required: Yes
Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes
Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

Connector

Description

Amazon Web Services Private CA Connector for Active Directory is a service that links your Active Directory with Amazon Web Services Private CA. The connector brokers the exchange of certificates from Amazon Web Services Private CA to domain-joined users and machines managed with Active Directory.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

Type: string

Certificate enrollment endpoint for Active Directory domain-joined objects reach out to when requesting certificates.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

Type: string

The identifier of the Active Directory.

Status

Type: string

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

Type: string

Additional information about the connector status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

ConnectorSummary

Description

Summary description of the Amazon Web Services Private CA AD connectors belonging to an Amazon Web Services account.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

Type: string

Certificate enrollment endpoint for Active Directory domain-joined objects to request certificates.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

Type: string

The identifier of the Active Directory.

Status

Type: string

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

Type: string

Additional information about the connector status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

DirectoryRegistration

Description

The directory registration represents the authorization of the connector service with a directory.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

Type: string

The identifier of the Active Directory.

Status

Type: string

Status of the directory registration.

StatusReason

Type: string

Additional information about the directory registration status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

DirectoryRegistrationSummary

Description

The directory registration represents the authorization of the connector service with the Active Directory.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

Type: string

The identifier of the Active Directory.

Status

Type: string

Status of the directory registration.

StatusReason

Type: string

Additional information about the directory registration status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

EnrollmentFlagsV2

Description

Template configurations for v2 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

Type: boolean

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

RemoveInvalidCertificateFromPersonalStore

Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV3

Description

Template configurations for v3 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

Type: boolean

RemoveInvalidCertificateFromPersonalStore

Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV4

Description

Template configurations for v4 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Type: boolean

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Type: boolean

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

Type: boolean

RemoveInvalidCertificateFromPersonalStore

Type: boolean

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Type: boolean

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

ExtensionsV2

Description

Certificate extensions for v2 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes
Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV3

Description

Certificate extensions for v3 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes
Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV4

Description

Certificate extensions for v4 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes
Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

GeneralFlagsV2

Description

General flags for v2 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users.

GeneralFlagsV3

Description

General flags for v3 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

GeneralFlagsV4

Description

General flags for v4 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Type: boolean

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Type: boolean

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

InternalServerException

Description

The request processing has failed because of an unknown error, exception or failure with an internal server.

Members

Message

Required: Yes
Type: string

KeyUsage

Description

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

Critical

Type: boolean

Sets the key usage extension to critical.

UsageFlags

Required: Yes
Type: KeyUsageFlags structure

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

KeyUsageFlags

Description

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

DataEncipherment

Type: boolean

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

DigitalSignature

Type: boolean

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

KeyAgreement

Type: boolean

KeyAgreement is asserted when the subject public key is used for key agreement.

KeyEncipherment

Type: boolean

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

NonRepudiation

Type: boolean

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

KeyUsageProperty

Description

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

Members

PropertyFlags

Type: KeyUsagePropertyFlags structure

You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both.

PropertyType

Type: string

You can specify all key usages using property type ALL. You can use property type or property flags but not both.

KeyUsagePropertyFlags

Description

Specifies key usage.

Members

Decrypt

Type: boolean

Allows key for encryption and decryption.

KeyAgreement

Type: boolean

Allows key exchange without encryption.

Sign

Type: boolean

Allow key use for digital signature.

PrivateKeyAttributesV2

Description

Defines the attributes of the private key.

Members

CryptoProviders

Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes
Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

MinimalKeyLength

Required: Yes
Type: int

Set the minimum key length of the private key.

PrivateKeyAttributesV3

Description

Defines the attributes of the private key.

Members

Algorithm

Required: Yes
Type: string

Defines the algorithm used to generate the private key.

CryptoProviders

Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes
Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

Required: Yes
Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

Required: Yes
Type: int

Set the minimum key length of the private key.

PrivateKeyAttributesV4

Description

Defines the attributes of the private key.

Members

Algorithm

Type: string

Defines the algorithm used to generate the private key.

CryptoProviders

Type: Array of strings

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes
Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

Required: Yes
Type: int

Set the minimum key length of the private key.

PrivateKeyFlagsV2

Description

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

Members

ClientVersion

Required: Yes
Type: string

Defines the minimum client compatibility.

ExportableKey

Type: boolean

Allows the private key to be exported.

StrongKeyProtectionRequired

Type: boolean

Require user input when using the private key for enrollment.

PrivateKeyFlagsV3

Description

Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used.

Members

ClientVersion

Required: Yes
Type: string

Defines the minimum client compatibility.

ExportableKey

Type: boolean

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

Type: boolean

Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

StrongKeyProtectionRequired

Type: boolean

Requirer user input when using the private key for enrollment.

PrivateKeyFlagsV4

Description

Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key.

Members

ClientVersion

Required: Yes
Type: string

Defines the minimum client compatibility.

ExportableKey

Type: boolean

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

Type: boolean

Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

RequireSameKeyRenewal

Type: boolean

Renew certificate using the same private key.

StrongKeyProtectionRequired

Type: boolean

Require user input when using the private key for enrollment.

UseLegacyProvider

Type: boolean

Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers.

ResourceNotFoundException

Description

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

Members

Message

Required: Yes
Type: string

ResourceId

Required: Yes
Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes
Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServicePrincipalName

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.html.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Status

Type: string

The status of a service principal name.

StatusReason

Type: string

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was updated.

ServicePrincipalNameSummary

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

Status

Type: string

The status of a service principal name.

StatusReason

Type: string

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

Time when the service principal name was updated.

ServiceQuotaExceededException

Description

Request would cause a service quota to be exceeded.

Members

Message

Required: Yes
Type: string

QuotaCode

Required: Yes
Type: string

The code associated with the service quota.

ResourceId

Required: Yes
Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes
Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServiceCode

Required: Yes
Type: string

Identifies the originating service.

SubjectNameFlagsV2

Description

Information to include in the subject name and alternate subject name of the certificate. The subject name can be common name, directory path, DNS as common name, or left blank. You can optionally include email to the subject name for user templates. If you leave the subject name blank then you must set a subject alternate name. The subject alternate name (SAN) can include globally unique identifier (GUID), DNS, domain DNS, email, service principal name (SPN), and user principal name (UPN). You can leave the SAN blank. If you leave the SAN blank, then you must set a subject name.

Members

RequireCommonName

Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Type: boolean

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV3

Description

Members

RequireCommonName

Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Type: boolean

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV4

Description

Members

RequireCommonName

Type: boolean

Include the common name in the subject name.

RequireDirectoryPath

Type: boolean

Include the directory path in the subject name.

RequireDnsAsCn

Type: boolean

Include the DNS as common name in the subject name.

RequireEmail

Type: boolean

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Type: boolean

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Type: boolean

Include the DNS in the subject alternate name.

SanRequireDomainDns

Type: boolean

Include the domain DNS in the subject alternate name.

SanRequireEmail

Type: boolean

Include the subject's email in the subject alternate name.

SanRequireSpn

Type: boolean

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Type: boolean

Include the user principal name (UPN) in the subject alternate name.

Template

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

Type: TemplateDefinition structure

Name

Type: string

Name of the templates. Template names must be unique.

ObjectIdentifier

Type: string

Object identifier of a template.

PolicySchema

Type: int

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

Type: TemplateRevision structure

The version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

Type: string

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateDefinition

Description

Members

TemplateV2

Type: TemplateV2 structure

TemplateV3

Type: TemplateV3 structure

TemplateV4

Type: TemplateV4 structure

TemplateRevision

Description

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Members

MajorRevision

Required: Yes
Type: int

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

MinorRevision

Required: Yes
Type: int

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

TemplateSummary

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

Type: TemplateDefinition structure

Name

Type: string

Name of the template. The template name must be unique.

ObjectIdentifier

Type: string

Object identifier of a template.

PolicySchema

Type: int

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

Type: TemplateRevision structure

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

Type: string

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateV2

Description

v2 template schema that uses Legacy Cryptographic Providers.

Members

CertificateValidity

Required: Yes
Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes
Type: EnrollmentFlagsV2 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes
Type: ExtensionsV2 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes
Type: GeneralFlagsV2 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

PrivateKeyAttributes

Required: Yes
Type: PrivateKeyAttributesV2 structure

Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers.

PrivateKeyFlags

Required: Yes
Type: PrivateKeyFlagsV2 structure

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

SubjectNameFlags

Required: Yes
Type: SubjectNameFlagsV2 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

Type: Array of strings

List of templates in Active Directory that are superseded by this template.

TemplateV3

Description

v3 template schema that uses Key Storage Providers.

Members

CertificateValidity

Required: Yes
Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes
Type: EnrollmentFlagsV3 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes
Type: ExtensionsV3 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes
Type: GeneralFlagsV3 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

Required: Yes
Type: string

Specifies the hash algorithm used to hash the private key.

PrivateKeyAttributes

Required: Yes
Type: PrivateKeyAttributesV3 structure

Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers.

PrivateKeyFlags

Required: Yes
Type: PrivateKeyFlagsV3 structure

SubjectNameFlags

Required: Yes
Type: SubjectNameFlagsV3 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

Type: Array of strings

List of templates in Active Directory that are superseded by this template.

TemplateV4

Description

v4 template schema that can use either Legacy Cryptographic Providers or Key Storage Providers.

Members

CertificateValidity

Required: Yes
Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes
Type: EnrollmentFlagsV4 structure

Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes
Type: ExtensionsV4 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes
Type: GeneralFlagsV4 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

Type: string

Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers.

PrivateKeyAttributes

Required: Yes
Type: PrivateKeyAttributesV4 structure

Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags.

PrivateKeyFlags

Required: Yes
Type: PrivateKeyFlagsV4 structure

SubjectNameFlags

Required: Yes
Type: SubjectNameFlagsV4 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

Type: Array of strings

List of templates in Active Directory that are superseded by this template.

ThrottlingException

Description

The limit on the number of requests per second was exceeded.

Members

Message

Required: Yes
Type: string

QuotaCode

Type: string

The code associated with the quota.

ServiceCode

Type: string

Identifies the originating service.

ValidationException

Description

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

Members

Message

Required: Yes
Type: string

Reason

Type: string

The reason for the validation error. This won't be return for every validation exception.

ValidityPeriod

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in hours, days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

Period

Required: Yes
Type: long (int|float)

The numeric value for the validity period.

PeriodType

Required: Yes
Type: string

The unit of time. You can select hours, days, weeks, months, and years.

VpcInformation

Description

Information about your VPC and security groups used with the connector.

Members

SecurityGroupIds

Required: Yes
Type: Array of strings

The security groups used with the connector. You can use a maximum of 4 security groups with a connector.

PcaConnectorAd 2018-05-10

Operation Summary

Paginators

Operations

CreateConnector

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateDirectoryRegistration

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateServicePrincipalName

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

CreateTemplate

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Members

Errors

CreateTemplateGroupAccessControlEntry

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteConnector

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteDirectoryRegistration

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteServicePrincipalName

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteTemplate

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

DeleteTemplateGroupAccessControlEntry

Parameter Syntax

Parameter Details

Members

Result Syntax

Result Details

Errors

GetConnector

Parameter Syntax

Parameter Details