certificate_authority_audit_reports

Creates, updates, deletes, gets or lists a certificate_authority_audit_reports resource.

Overview

Name	certificate_authority_audit_reports
Type	Resource
Id	aws.acm_pca.certificate_authority_audit_reports

Fields

The following fields are returned by SELECT queries:

describe_certificate_authority_audit_report

Name	Datatype	Description
audit_report_status	string	Specifies whether report creation is in progress, has succeeded, or has failed. (CREATING, SUCCESS, FAILED)
created_at	string (date-time)	The date and time at which the report was created.
s3_bucket_name	string	Name of the S3 bucket that contains the report.
s3_key	string	S3 key that uniquely identifies the report file in your S3 bucket.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_certificate_authority_audit_report	select	region		Lists information about a specific audit report created by calling the CreateCertificateAuthorityAuditReport action. Audit information is created every time the certificate authority (CA) private key is used. The private key is used when you call the IssueCertificate action or the RevokeCertificate action.
create_certificate_authority_audit_report	insert	region, CertificateAuthorityArn, S3BucketName, AuditReportResponseFormat		Creates an audit report that lists every time that your CA private key is used to issue a certificate. The IssueCertificate and RevokeCertificate actions use the private key. To save the audit report to your designated Amazon S3 bucket, you must create a bucket policy that grants Amazon Web Services Private CA permission to access and write to it. For an example policy, see Prepare an Amazon S3 bucket for audit reports. Amazon Web Services Private CA assets that are stored in Amazon S3 can be protected with encryption. For more information, see Encrypting Your Audit Reports. You can generate a maximum of one report every 30 minutes.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_certificate_authority_audit_report

Lists information about a specific audit report created by calling the CreateCertificateAuthorityAuditReport action. Audit information is created every time the certificate authority (CA) private key is used. The private key is used when you call the IssueCertificate action or the RevokeCertificate action.

SELECT
audit_report_status,
created_at,
s3_bucket_name,
s3_key
FROM aws.acm_pca.certificate_authority_audit_reports
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_certificate_authority_audit_report

Creates an audit report that lists every time that your CA private key is used to issue a certificate. The IssueCertificate and RevokeCertificate actions use the private key. To save the audit report to your designated Amazon S3 bucket, you must create a bucket policy that grants Amazon Web Services Private CA permission to access and write to it. For an example policy, see Prepare an Amazon S3 bucket for audit reports. Amazon Web Services Private CA assets that are stored in Amazon S3 can be protected with encryption. For more information, see Encrypting Your Audit Reports. You can generate a maximum of one report every 30 minutes.

INSERT INTO aws.acm_pca.certificate_authority_audit_reports (
CertificateAuthorityArn,
S3BucketName,
AuditReportResponseFormat,
region
)
SELECT 
'{{ CertificateAuthorityArn }}' /* required */,
'{{ S3BucketName }}' /* required */,
'{{ AuditReportResponseFormat }}' /* required */,
'{{ region }}'
RETURNING
audit_report_id,
s3_key
;

Manifest

# Description fields are for documentation purposes
- name: certificate_authority_audit_reports
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the certificate_authority_audit_reports resource.
  - name: CertificateAuthorityArn
    value: "{{ CertificateAuthorityArn }}"
    description: |
      The Amazon Resource Name (ARN) of the CA to be audited. This is of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 .
  - name: S3BucketName
    value: "{{ S3BucketName }}"
    description: |
      The name of the S3 bucket that will contain the audit report.
  - name: AuditReportResponseFormat
    value: "{{ AuditReportResponseFormat }}"
    description: |
      The format in which to create the report. This can be either JSON or CSV.
    valid_values: ['JSON', 'CSV']