AWS privateca documentation change
Summary
Added two new CloudWatch metrics (CertificateAuthority and CertificatesPerCA) for monitoring private certificate authority inventory and certificate issuance volume, with a note about availability timeline for existing CAs.
Security assessment
The change adds monitoring metrics for operational visibility but does not address any security vulnerability or weakness. The note about delayed metric availability until April 30, 2026 for CAs created before March 26, 2026 is a feature rollout timeline, not a security fix. Monitoring metrics can support security operations but are not themselves security features.
Diff
diff --git a/privateca/latest/userguide/PcaCloudWatch.md b/privateca/latest/userguide/PcaCloudWatch.md index e8a66d596..bd701d7e2 100644 --- a//privateca/latest/userguide/PcaCloudWatch.md +++ b//privateca/latest/userguide/PcaCloudWatch.md @@ -17,0 +18,6 @@ Metric | Description +`CertificateAuthority` | The total number of private certificate authorities in your account in the current Region. This metric includes CAs in all states (ACTIVE, DISABLED, CREATING, etc.) and can be used to monitor CA inventory and track usage against account quotas. +`CertificatesPerCA` | The total number of certificates issued by a specific private certificate authority since its creation. This metric increments with each successful certificate issuance and is not decremented when certificates expire or are revoked. This metric applies to individual private CAs and can be used to track certificate issuance volume and capacity planning. This metric is only published in the owner account and is not available in accounts that the CA is shared to. + +###### Note + +For any private CAs created prior to March 26, 2026, the `CertificateAuthority` and `CertificatesPerCA` metrics might take until April 30, 2026 to be available in CloudWatch.