# Say Goodbye to Re-Importing CRLs: IAM Roles Anywhere Automates Revocation Checking

Hi, it's Shii-chan!

I found a nice update that takes one chore off your operations list.

## What was announced?

In AWS's What's New feed, AWS Identity and Access Management (IAM) Roles Anywhere now supports automatic revocation checking using certificate revocation list (CRL) distribution points (CDPs). It helps keep revocation checks in sync with your certificate authority (CA) and can improve your security posture.

## The story so far

To check revocation status, you had to import CRLs into IAM Roles Anywhere and re-import them each time your CA published an update. That added operational overhead.

## What changes

When you enable the capability on a trust anchor, IAM Roles Anywhere reads the CDP URLs embedded in authenticating certificates, downloads the corresponding CRLs, and denies credential requests that use revoked certificates. CRLs are refreshed periodically, so re-importing is no longer needed.

## Dive Deep

- Supported PKI: AWS Private Certificate Authority or your own public key infrastructure (PKI), as long as your certificates include publicly accessible CDP URLs that meet the distribution point requirements
- How to enable: per trust anchor, using the IAM Roles Anywhere console, AWS SDKs, or AWS CLI
- Cost and Regions: no additional cost, in all commercial AWS Regions

See "Automatic revocation checking with CRL distribution points" in the IAM Roles Anywhere User Guide for the requirements.

## Wrap-up

- CRLs are fetched automatically from CDPs, and requests with revoked certificates are denied
- No more manual CRL import and re-import
- Works with AWS Private CA or your own PKI (publicly accessible CDP URLs required)
- No additional cost, all commercial Regions

This is for anyone using IAM Roles Anywhere for on-premises workloads who found CRL upkeep tedious!