certificates

Creates, updates, deletes, gets or lists a certificates resource.

Overview

Name	certificates
Type	Resource
Id	aws.rds.certificates

Fields

The following fields are returned by SELECT queries:

describe_certificates

Name	Datatype	Description
certificate_arn	string	The Amazon Resource Name (ARN) for the certificate.
certificate_identifier	string	The unique key that identifies a certificate.
certificate_type	string	The type of the certificate.
customer_override	boolean	Indicates whether there is an override for the default certificate identifier.
customer_override_valid_till	string	If there is an override for the default certificate identifier, when the override expires.
thumbprint	string	The thumbprint of the certificate.
valid_from	string	The starting date from which the certificate is valid.
valid_till	string	The final date that the certificate continues to be valid.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_certificates	select	region	CertificateIdentifier, Filters, MaxRecords, Marker	Lists the set of certificate authority (CA) certificates provided by Amazon RDS for this Amazon Web Services account. For more information, see Using SSL/TLS to encrypt a connection to a DB instance in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to a DB cluster in the Amazon Aurora User Guide.
modify_certificates	update	region	CertificateIdentifier, RemoveCustomerOverride	Override the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances, or remove the override. By using this operation, you can specify an RDS-approved SSL/TLS certificate for new DB instances that is different from the default certificate provided by RDS. You can also use this operation to remove the override, so that new DB instances use the default certificate provided by RDS. You might need to override the default certificate in the following situations: You already migrated your applications to support the latest certificate authority (CA) certificate, but the new CA certificate is not yet the RDS default CA certificate for the specified Amazon Web Services Region. RDS has already moved to a new default CA certificate for the specified Amazon Web Services Region, but you are still in the process of supporting the new CA certificate. In this case, you temporarily need additional time to finish your application changes. For more information about rotating your SSL/TLS certificate for RDS DB engines, see Rotating Your SSL/TLS Certificate in the Amazon RDS User Guide. For more information about rotating your SSL/TLS certificate for Aurora DB engines, see Rotating Your SSL/TLS Certificate in the Amazon Aurora User Guide.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
CertificateIdentifier	string	The new default certificate identifier to override the current one with. To determine the valid values, use the describe-certificates CLI command or the DescribeCertificates API operation.
Filters	array	This parameter isn't currently supported.
Marker	string	An optional pagination token provided by a previous DescribeCertificates request. If this parameter is specified, the response includes only records beyond the marker, up to the value specified by MaxRecords.
MaxRecords	integer	The maximum number of records to include in the response. If more records exist than the specified MaxRecords value, a pagination token called a marker is included in the response so you can retrieve the remaining results. Default: 100 Constraints: Minimum 20, maximum 100.
RemoveCustomerOverride	boolean	Specifies whether to remove the override for the default certificate. If the override is removed, the default certificate is the system default.

SELECT examples

describe_certificates

Lists the set of certificate authority (CA) certificates provided by Amazon RDS for this Amazon Web Services account. For more information, see Using SSL/TLS to encrypt a connection to a DB instance in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to a DB cluster in the Amazon Aurora User Guide.

SELECT
certificate_arn,
certificate_identifier,
certificate_type,
customer_override,
customer_override_valid_till,
thumbprint,
valid_from,
valid_till
FROM aws.rds.certificates
WHERE region = '{{ region }}' -- required
AND CertificateIdentifier = '{{ CertificateIdentifier }}'
AND Filters = '{{ Filters }}'
AND MaxRecords = '{{ MaxRecords }}'
AND Marker = '{{ Marker }}'
;

UPDATE examples

modify_certificates

Override the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances, or remove the override. By using this operation, you can specify an RDS-approved SSL/TLS certificate for new DB instances that is different from the default certificate provided by RDS. You can also use this operation to remove the override, so that new DB instances use the default certificate provided by RDS. You might need to override the default certificate in the following situations: You already migrated your applications to support the latest certificate authority (CA) certificate, but the new CA certificate is not yet the RDS default CA certificate for the specified Amazon Web Services Region. RDS has already moved to a new default CA certificate for the specified Amazon Web Services Region, but you are still in the process of supporting the new CA certificate. In this case, you temporarily need additional time to finish your application changes. For more information about rotating your SSL/TLS certificate for RDS DB engines, see Rotating Your SSL/TLS Certificate in the Amazon RDS User Guide. For more information about rotating your SSL/TLS certificate for Aurora DB engines, see Rotating Your SSL/TLS Certificate in the Amazon Aurora User Guide.

UPDATE aws.rds.certificates
SET 
-- No updatable properties
WHERE 
region = '{{ region }}' --required
AND CertificateIdentifier = '{{ CertificateIdentifier}}'
AND RemoveCustomerOverride = {{ RemoveCustomerOverride}}
RETURNING
certificate_arn,
certificate_identifier,
certificate_type,
customer_override,
customer_override_valid_till,
thumbprint,
valid_from,
valid_till;