mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Add PKI sync AWS Certificate Manager
This commit is contained in:
Carlos Monastyrski
@@ -0,0 +1,149 @@
|
||||
---
|
||||
title: "AWS Certificate Manager"
|
||||
description: "Learn how to configure an AWS Certificate Manager Certificate Sync for Infisical PKI."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
|
||||
- Create an [AWS Connection](/integrations/app-connections/aws)
|
||||
- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
|
||||
|
||||
<Note>
|
||||
The AWS Certificate Manager Certificate Sync requires the following ACM permissions to be set on the IAM user/role
|
||||
for Infisical to sync certificates to AWS Certificate Manager: `acm:ListCertificates`, `acm:DescribeCertificate`, `acm:ImportCertificate`, `acm:DeleteCertificate`, and `acm:ListTagsForCertificate`.
|
||||
|
||||
These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Certificates synced to AWS Certificate Manager will be stored as imported certificates, preserving both the certificate and private key components.
|
||||
</Note>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **AWS Certificate Manager** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
|
||||
|
||||
4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **AWS Connection**: The AWS Connection to authenticate with.
|
||||
- **AWS Region**: The AWS region where certificates should be stored.
|
||||
<p class="height:1px" />
|
||||
|
||||
5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
|
||||
- **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
|
||||
<Tip>
|
||||
**AWS Certificate Manager Certificate Limits**: AWS Certificate Manager has limits on the number of certificates per account and region. Refer to AWS documentation for current limits. Deleted certificates count toward your quota until they are permanently purged by AWS (typically after 30 days).
|
||||
</Tip>
|
||||
|
||||
6. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your AWS Certificate Manager Certificate Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your AWS Certificate Manager Certificate Sync will begin syncing your certificates to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **AWS Certificate Manager Certificate Sync**, make an API request to the [Create AWS Certificate Manager Certificate Sync](/api-reference/endpoints/pki/syncs/aws-certificate-manager/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/aws-certificate-manager \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-acm-cert-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example certificate sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "aws-certificate-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```json Response
|
||||
{
|
||||
"pkiSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-acm-cert-sync",
|
||||
"description": "an example certificate sync",
|
||||
"destination": "aws-certificate-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-01-01T00:00:00.000Z",
|
||||
"updatedAt": "2023-01-01T00:00:00.000Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Your AWS Certificate Manager Certificate Sync will:
|
||||
|
||||
- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to AWS Certificate Manager
|
||||
- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur
|
||||
- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled)
|
||||
- **Format Preservation**: Maintain certificate format and metadata during sync operations
|
||||
- **Tagging**: Automatically tag certificates with an InfisicalCertificate tag for easy identification and management
|
||||
|
||||
<Note>
|
||||
AWS Certificate Manager Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually trigger certificate synchronization from your PKI subscriber to AWS Certificate Manager using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/aws-certificate-manager/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
AWS Certificate Manager does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from AWS Certificate Manager. Only certificates imported into ACM (not AWS-issued certificates) can be managed by the sync.
|
||||
</Note>
|
||||
Reference in New Issue
Block a user