Skip to content

Create an AWS Public CA Connector

This feature is in Preview

This feature is currently available as a Preview and is not yet generally available (GA). Functionality and behavior may change before GA.

AWS provides a service that streamlines the procurement and management of SSL/TLS certificates. CyberArk has partnered with AWS to give you the ability to quickly and easily request and renew certificates.

Before you begin

You're going to need a few things to complete this procedure.

  • You will need an AWS account.
  • Your AWS access ID.
  • Your AWS secret access key
  • You will need at least one active VSatellite to provision certificates to AWS.

  • CyberArk permissions for AWS IAM - you must attach the relevant IAM policies in the following JSON file to the CyberArk Certificate Manager - SaaS AWS Integration IAM Role in your AWS account:

    {
"Version":"2012-10-17",
"Statement":[
    {
        "Effect":"Allow",
        "Action":[
            "acm:ListCertificates",
            "acm:GetCertificate",
            "acm:RequestCertificate",
            "acm:DescribeCertificate"
        ],
        "Resource":"*"
    }
]
}
    For more information, refer to Configure AWS Connection

  1. Sign in to Certificate Manager - SaaS.

  2. Click Integrations > Certificate Authorities.

  3. Click New > AWS.

  4. Select a VSatellite.
  5. Select a certificate authority type.
  6. Click Next.
  7. Select a region.
  8. Enter your AWS access ID.

  9. Enter your AWS secret access key.

    Note

    The AWS access ID and AWS secret access key authenticate and authorize requests to AWS. These credentials uniquely identify the AWS user or role and verify their permissions to perform actions through the AWS API. They're essential for secure communication and automation between CyberArk and AWS.

  10. Click Test Access, then click Next.

  11. (Optional) In Product Options, select the certificate authority products to map to request policies.
  12. (Optional) Click Add.
  13. Click Create.

Good to know

  • Private keys are managed by AWS. When you request a certificate through this connector, AWS Certificate Manager generates and manages the key pair. The CSR submitted by Certificate Manager - SaaS is used to extract the domain name, SANs, and key algorithm, but the CSR itself is not forwarded to AWS. This means the private key associated with the issued certificate is not the same key that signed the original CSR.

  • Private key export is not available. The connector does not currently support exporting the AWS-managed private key. Issued certificates can only be used with AWS integrated services (CloudFront, Elastic Load Balancing, API Gateway, etc.).

What's next

This CA is now ready to be added to one or more request policies. To do this, select this CA when creating request policies.