# AWS Private CA Now Logs Every Certificate Issuance in Detail!

Hello everyone, it's Shii-chan! Here's an update that makes certificate auditing much easier, so let me walk you through it!

## What was announced?

AWS What's New announced detailed certificate issuance logs for AWS Private CA.

A new CloudTrail service event, `IssueCertificateDetails`, records the following for every issuance:

- The complete certificate content
- Information about the issuing CA
- The requester's identity
- The signing status

## The story so far

Until now, the CloudTrail management event for the `IssueCertificate` API only confirmed that the call succeeded and gave you a certificate ARN.

- It did not capture the certificate content
- It did not capture which CA signed it
- It did not record issuances that failed before signing

## What changes

You can now follow the whole issuance story from CloudTrail alone! AWS lists these use cases:

- Compliance auditing
- Certificate inventory
- Algorithm migration tracking
- Failed-issuance monitoring

If you're planning a migration, being able to see which algorithms your issued certificates use is a real help!

## Dive Deep

Here's what's in the event:

- The complete to-be-signed (TBS) certificate with all X.509 fields and extensions
- Convenience fields: subject, issuer, serial number, validity period, template and signing algorithm

Events are emitted for failures too. For example, a pre-signing failure such as a name constraints violation now produces a record with a failure explanation.

The requester is identified differently depending on the path:

- Direct API callers: the account and IAM principal
- Certificates issued through AWS Private CA connectors or integrated AWS services: the service principal

In cross-account configurations, the event is delivered to the CA owner account.

It's delivered automatically as a CloudTrail management event, with no configuration or opt-in required. There is no additional cost beyond standard AWS CloudTrail pricing. It's available in all AWS Regions where AWS Private CA is offered, and you can use Amazon EventBridge for real-time handling or Amazon Athena for batch queries.

## Wrap-up

- The new `IssueCertificateDetails` event records the full certificate, CA info, requester and signing status
- Pre-signing failures are logged too, with a failure explanation
- No setup, and no cost beyond standard CloudTrail pricing
- Works with EventBridge and Athena for auditing and monitoring

This is great for anyone running a private PKI who needs better audits and migration tracking!