AWS privateca medium security documentation change
Summary
Removed option to create new S3 buckets for CRLs; now requires selecting existing buckets only. Removed sections about automatic bucket creation failures due to Block Public Access settings.
Security assessment
The change removes functionality that automatically created S3 buckets with potentially insecure public access settings. This addresses a security weakness where publicly accessible CRL buckets could expose revocation data. The removal of automatic bucket creation prevents misconfigurations that bypass Block Public Access protections.
Diff
diff --git a/privateca/latest/userguide/create-CA.md b/privateca/latest/userguide/create-CA.md index 73a2e987e..ec691f456 100644 --- a//privateca/latest/userguide/create-CA.md +++ b//privateca/latest/userguide/create-CA.md @@ -117 +117 @@ To configure **Certificate revocation options** , perform the following steps. - 2. To create an Amazon S3 bucket for your CRL entries, choose **Create a new S3 bucket** and type a unique bucket name. (You do not need to include the path to the bucket.) Otherwise, under **S3 bucket URI** , choose an existing bucket from the list. + 2. Under **S3 bucket URI** , choose an existing bucket from the list. @@ -119,13 +119 @@ To configure **Certificate revocation options** , perform the following steps. -When you create a new bucket through the console, AWS Private CA attempts to attach the [required access policy](./crl-planning.html#s3-policies) to the bucket, and to disable the S3 default Block Public Access (BPA) setting on it. If you instead specify an existing bucket, you must ensure that BPA is disabled for the account and for the bucket. Otherwise, the operation to create the CA fail. If the CA is created successfully, you must still manually attach a policy to it before you can begin generating CRLs. Use one of the policy patterns described in [Access policies for CRLs in Amazon S3 ](./crl-planning.html#s3-policies). For more information, see [Adding a bucket policy using the Amazon S3 console.](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-bucket-policy.html) - -###### Important - -An attempt to create a CA using the AWS Private CA console fails if all of the following conditions apply: - - * You are setting up a CRL. - - * You ask AWS Private CA to create an S3 bucket automatically. - - * You are enforcing BPA settings in S3. - -In this situation, the console creates a bucket, but attempts and fails to make it publicly accessible. Check your Amazon S3 settings if this occurs, disable BPA as needed, and then repeat the procedure for creating a CA. For more information, see [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html). +When you specify an existing bucket, you must ensure that BPA is disabled for the account and for the bucket. Otherwise, the operation to create the CA fail. If the CA is created successfully, you must still manually attach a policy to it before you can begin generating CRLs. Use one of the policy patterns described in [Access policies for CRLs in Amazon S3 ](./crl-planning.html#s3-policies). For more information, see [Adding a bucket policy using the Amazon S3 console.](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-bucket-policy.html) @@ -143,2 +130,0 @@ In this situation, the console creates a bucket, but attempts and fails to make - 4. Expand **S3 settings** for optional configuration of **Bucket versioning** and **Bucket access logging**. -