JA EN
shiichan

AWS Private CA Now Logs Every Certificate Issuance in Detail!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hello everyone, it's Shii-chan! Here's an update that makes certificate auditing much easier, so let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced detailed certificate issuance logs for AWS Private CA.

A new CloudTrail service event, IssueCertificateDetails, records the following for every issuance:

  • The complete certificate content
  • Information about the issuing CA
  • The requester's identity
  • The signing status

The story so far

Until now, the CloudTrail management event for the IssueCertificate API only confirmed that the call succeeded and gave you a certificate ARN.

  • It did not capture the certificate content
  • It did not capture which CA signed it
  • It did not record issuances that failed before signing

What changes

You can now follow the whole issuance story from CloudTrail alone! AWS lists these use cases:

  • Compliance auditing
  • Certificate inventory
  • Algorithm migration tracking
  • Failed-issuance monitoring

If you're planning a migration, being able to see which algorithms your issued certificates use is a real help!

Dive Deep

Here's what's in the event:

  • The complete to-be-signed (TBS) certificate with all X.509 fields and extensions
  • Convenience fields: subject, issuer, serial number, validity period, template and signing algorithm

Events are emitted for failures too. For example, a pre-signing failure such as a name constraints violation now produces a record with a failure explanation.

The requester is identified differently depending on the path:

  • Direct API callers: the account and IAM principal
  • Certificates issued through AWS Private CA connectors or integrated AWS services: the service principal

In cross-account configurations, the event is delivered to the CA owner account.

It's delivered automatically as a CloudTrail management event, with no configuration or opt-in required. There is no additional cost beyond standard AWS CloudTrail pricing. It's available in all AWS Regions where AWS Private CA is offered, and you can use Amazon EventBridge for real-time handling or Amazon Athena for batch queries.

Wrap-up

  • The new IssueCertificateDetails event records the full certificate, CA info, requester and signing status
  • Pre-signing failures are logged too, with a failure explanation
  • No setup, and no cost beyond standard CloudTrail pricing
  • Works with EventBridge and Athena for auditing and monitoring

This is great for anyone running a private PKI who needs better audits and migration tracking!

Related posts