AWS general documentation change
Summary
Updated PCA service quotas documentation with revised certificate limits based on CRL usage. Split 'Number of private certificates per CA' into separate entries for CAs with/without complete CRLs, increased non-CRL CA certificate limit to 20M, and added clarification about revoked certificate quotas.
Security assessment
The changes differentiate quotas based on CRL usage (a security feature), but there's no evidence of addressing a specific vulnerability. The updates clarify operational limits related to security mechanisms without indicating a resolved security issue.
Diff
diff --git a/general/latest/gr/pca.md index c589c5af8..ba8b84d41 100644 --- a/general/latest/gr/pca.md +++ b/general/latest/gr/pca.md @@ -127,26 +127,27 @@ Name | Default | Adjustable | Description -Number of private certificate authorities (CAs) | Each supported Region: 200 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-799883CD) | The maximum number of private certificate authorities (CAs) that you can create in this account in the current Region. -Number of private certificates per CA | Each supported Region: 1,000,000 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-F99AB81B) | The maximum number of private certificates per certificate authority (CA) that you can create in this account in the current Region. -Number of revoked private certificates per CA | Each supported Region: 1,000,000 | No | The maximum number of private certificates per certificate authority (CA) that you can revoke in this account in the current Region. -Rate of CreateCertificateAuthority requests | Each supported Region: 1 | No | The maximum number of CreateCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of CreateCertificateAuthorityAuditReport requests | Each supported Region: 1 | No | The maximum number of CreateCertificateAuthorityAuditReport requests that you can perform in this account in the current region per second. -Rate of CreatePermission requests | Each supported Region: 1 | No | The maximum number of CreatePermission requests that you can perform in this account in the current region per second. -Rate of DeleteCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of DeleteCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of DeletePermission requests | Each supported Region: 1 | No | The maximum number of DeletePermission requests that you can perform in this account in the current region per second. -Rate of DeletePolicy requests | Each supported Region: 5 | No | The maximum number of DeletePolicy requests that you can perform in this account in the current region per second. -Rate of DescribeCertificateAuthority requests | Each supported Region: 20 | No | The maximum number of DescribeCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of DescribeCertificateAuthorityAuditReport requests | Each supported Region: 20 | No | The maximum number of DescribeCertificateAuthorityAuditReport requests that you can perform in this account in the current region per second. -Rate of GetCertificate requests | Each supported Region: 75 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-1725E639) | The maximum number of GetCertificate requests that you can perform in this account in the current region per second. -Rate of GetCertificateAuthorityCertificate requests | Each supported Region: 20 | No | The maximum number of GetCertificateAuthorityCertificate requests that you can perform in this account in the current region per second. -Rate of GetCertificateAuthorityCsr requests | Each supported Region: 10 | No | The maximum number of GetCertificateAuthorityCsr requests that you can perform in this account in the current region per second. -Rate of GetPolicy requests | Each supported Region: 5 | No | The maximum number of GetPolicy requests that you can perform in this account in the current region per second. -Rate of ImportCertificateAuthorityCertificate requests | Each supported Region: 10 | No | The maximum number of ImportCertificateAuthorityCertificate requests that you can perform in this account in the current region per second. -Rate of IssueCertificate requests | Each supported Region: 25 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-CAFB4993) | The maximum number of IssueCertificate requests that you can perform in this account in the current region per second. -Rate of ListCertificateAuthorities requests | Each supported Region: 20 | No | The maximum number of ListCertificateAuthorities requests that you can perform in this account in the current region per second. -Rate of ListPermissions requests | Each supported Region: 5 | No | The maximum number of ListPermissions requests that you can perform in this account in the current region per second. -Rate of ListTags requests | Each supported Region: 20 | No | The maximum number of ListTags requests that you can perform in this account in the current region per second. -Rate of PutPolicy requests | Each supported Region: 5 | No | The maximum number of PutPolicy requests that you can perform in this account in the current region per second. -Rate of RestoreCertificateAuthority requests | Each supported Region: 20 | No | The maximum number of RestoreCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of RevokeCertificate requests | Each supported Region: 20 | No | The maximum number of RevokeCertificate requests that you can perform in this account in the current region per second. -Rate of TagCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of TagCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of UntagCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of UntagCertificateAuthority requests that you can perform in this account in the current region per second. -Rate of UpdateCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of UpdateCertificateAuthority requests that you can perform in this account in the current region per second. +Number of private certificate authorities | Each supported Region: 200 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-799883CD) | The maximum number of private certificate authorities (CAs) that can be created in an account in the current Region. +Number of private certificates for each CA | Each supported Region: 20,000,000 | No | The maximum number of private certificates that a certificate authority (CA) can issue in an account in the current Region. This quota applies to CAs not using complete CRLs. +Number of private certificates for each CA using complete CRLs | Each supported Region: 1,000,000 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-F99AB81B) | The maximum number of private certificates that a certificate authority (CA) can issue in an account in the current Region. This quota applies to CAs using complete CRLs. +Number of revoked private certificates for each CA with complete CRLs enabled | Each supported Region: 1,000,000 | No | The maximum number of revoked, unexpired private certificates in an account in the current Region. This quota applies only to certificates issued when the CA had complete CRLs enabled. +Rate of CreateCertificateAuthority requests | Each supported Region: 1 | No | The maximum number of CreateCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of CreateCertificateAuthorityAuditReport requests | Each supported Region: 1 | No | The maximum number of CreateCertificateAuthorityAuditReport requests that can be performed in an account in the current Region each second. +Rate of CreatePermission requests | Each supported Region: 1 | No | The maximum number of CreatePermission requests that can be performed in an account in the current Region each second. +Rate of DeleteCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of DeleteCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of DeletePermission requests | Each supported Region: 1 | No | The maximum number of DeletePermission requests that can be performed in an account in the current Region each second. +Rate of DeletePolicy requests | Each supported Region: 5 | No | The maximum number of DeletePolicy requests that can be performed in an account in the current Region each second. +Rate of DescribeCertificateAuthority requests | Each supported Region: 20 | No | The maximum number of DescribeCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of DescribeCertificateAuthorityAuditReport requests | Each supported Region: 20 | No | The maximum number of DescribeCertificateAuthorityAuditReport requests that can be performed in an account in the current Region each second. +Rate of GetCertificate requests | Each supported Region: 75 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-1725E639) | The maximum number of GetCertificate requests that can be performed in an account in the current Region each second. +Rate of GetCertificateAuthorityCertificate requests | Each supported Region: 20 | No | The maximum number of GetCertificateAuthorityCertificate requests that can be performed in an account in the current Region each second. +Rate of GetCertificateAuthorityCsr requests | Each supported Region: 10 | No | The maximum number of GetCertificateAuthorityCsr requests that can be performed in an account in the current Region each second. +Rate of GetPolicy requests | Each supported Region: 5 | No | The maximum number of GetPolicy requests that can be performed in an account in the current Region each second. +Rate of ImportCertificateAuthorityCertificate requests | Each supported Region: 10 | No | The maximum number of ImportCertificateAuthorityCertificate requests that can be performed in an account in the current Region each second. +Rate of IssueCertificate requests | Each supported Region: 25 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/acm-pca/quotas/L-CAFB4993) | The maximum number of IssueCertificate requests that can be performed in an account in the current Region each second. +Rate of ListCertificateAuthorities requests | Each supported Region: 20 | No | The maximum number of ListCertificateAuthorities requests that can be performed in an account in the current Region each second. +Rate of ListPermissions requests | Each supported Region: 5 | No | The maximum number of ListPermissions requests that can be performed in an account in the current Region each second. +Rate of ListTags requests | Each supported Region: 20 | No | The maximum number of ListTags requests that can be performed in an account in the current Region each second. +Rate of PutPolicy requests | Each supported Region: 5 | No | The maximum number of PutPolicy requests that can be performed in an account in the current Region each second. +Rate of RestoreCertificateAuthority requests | Each supported Region: 20 | No | The maximum number of RestoreCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of RevokeCertificate requests | Each supported Region: 20 | No | The maximum number of RevokeCertificate requests that can be performed in an account in the current Region each second. +Rate of TagCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of TagCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of UntagCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of UntagCertificateAuthority requests that can be performed in an account in the current Region each second. +Rate of UpdateCertificateAuthority requests | Each supported Region: 10 | No | The maximum number of UpdateCertificateAuthority requests that can be performed in an account in the current Region each second.