AWS acm documentation change
Summary
Updated guidance on certificate usage: Added ACME protocol recommendation for EC2 automation, clarified Nitro Enclave requirements, and added note about ACME certificate limitations with AWS services.
Security assessment
Promotes secure certificate automation practices through ACME protocol and clarifies security boundaries (Nitro Enclave requirements), but doesn't address any specific vulnerability. Adds security documentation by explaining certificate origin limitations.
Diff
diff --git a/acm/latest/userguide/acm-services.md b/acm/latest/userguide/acm-services.md index 6be7121e6..e51eddb6d 100644 --- a//acm/latest/userguide/acm-services.md +++ b//acm/latest/userguide/acm-services.md @@ -13 +13,5 @@ AWS Certificate Manager supports a growing number of AWS services that can use A -Public ACM certificates can be installed on Amazon EC2 instances that are connected to a Nitro Enclave. You can also [export a public certificate](./export-public-certificate.html) to use on any Amazon EC2 instance. For information about setting up a standalone web server on an Amazon EC2 instance not connected to a Nitro Enclave, see [Tutorial: Install a LAMP web server on Amazon Linux 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-lamp-amazon-linux-2.html) or [Tutorial: Install a LAMP web server with the Amazon Linux AMI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/install-LAMP.html). +To automate public certificate issuance and renewal outside integrated services such as on Amazon EC2 instances, use the ACME protocol. For more information, see [ACME certificate automation](./acm-acme.html). Alternatively, if you cannot use ACME, you can automate exportable certificates issued from ACM through [AWS Workload Credentials Provider](./acm-certificate-automation.html). + +###### Note + +ACME certificates (certificates with `CertificateKeyPairOrigin` of `ACME`) cannot be used with AWS integrated services. To use certificates with the services listed below, use ACM-managed certificates with a key pair origin of `AWS_MANAGED` or `CUSTOMER_PROVIDED`. @@ -77 +81 @@ EC2 instances connected to Nitro Enclaves support ACM certificates. For more inf -You cannot associate ACM certificates with an EC2 instance that is not connected to a Nitro Enclave. +For publicly trusted certificates on Amazon EC2 instances, we recommend the ACME protocol, which automates certificate issuance and renewal directly on the instance, including instances that are not connected to a Nitro Enclave. For more information, see [ACME certificate automation](./acm-acme.html). Associating an ACM-managed certificate directly with an Amazon EC2 instance requires a Nitro Enclave. @@ -119 +123 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Reimport certificate +Issuing certificates