AWS acm documentation change
Summary
Restructured documentation to categorize ACM operations into Management Events and Data Events. Added comprehensive documentation for new ACME-related API operations including ChangeAccountKey, CreateAcmeDomainValidation, CreateAcmeEndpoint, CreateAcmeExternalAccountBinding, and others. Updated CloudTrail log examples with modern formats and security practices.
Security assessment
The changes introduce documentation for ACME protocol integrations which enhance certificate automation security. Sensitive fields like private keys and contact information are explicitly marked as 'HIDDEN_DUE_TO_SECURITY_REASONS' in examples. TLS 1.3 enforcement is documented in all examples, improving transport security guidance.
Diff
diff --git a/acm/latest/userguide/acm-supported-actions-in-cloudtrail.md b/acm/latest/userguide/acm-supported-actions-in-cloudtrail.md index 946c60c43..7e204ba7d 100644 --- a//acm/latest/userguide/acm-supported-actions-in-cloudtrail.md +++ b//acm/latest/userguide/acm-supported-actions-in-cloudtrail.md @@ -7 +7 @@ -Add tagsDeleting a certificate (DeleteCertificate)Describing a certificate (DescribeCertificate)Exporting a certificate (ExportCertificate)Import a certificate (ImportCertificate)Listing certificates (ListCertificates)List tagsRemoving TagsRequesting a certificate (RequestCertificate)Revoke a certificate (RevokeCertificate)Resend emailRetrieving a certificate (GetCertificate)Searching certificates (SearchCertificates) +Management eventsData events @@ -26 +26,3 @@ For more information, see the [CloudTrail userIdentity Element](https://docs.aws -The following sections provide example logs for the supported API operations. +ACM records management events and data events in CloudTrail. + +**Management events** @@ -29,0 +32,14 @@ The following sections provide example logs for the supported API operations. + * Changing an ACME account key (ChangeAccountKey) + + * Creating an ACME domain validation (CreateAcmeDomainValidation) + + * Creating an ACME endpoint (CreateAcmeEndpoint) + + * Creating an ACME external account binding (CreateAcmeExternalAccountBinding) + + * Deleting an ACME domain validation (DeleteAcmeDomainValidation) + + * Deleting an ACME endpoint (DeleteAcmeEndpoint) + + * Deleting an ACME external account binding (DeleteAcmeExternalAccountBinding) + @@ -31,0 +48,8 @@ The following sections provide example logs for the supported API operations. + * Describing an ACME account (DescribeAcmeAccount) + + * Describing an ACME domain validation (DescribeAcmeDomainValidation) + + * Describing an ACME endpoint (DescribeAcmeEndpoint) + + * Describing an ACME external account binding (DescribeAcmeExternalAccountBinding) + @@ -35,0 +60,4 @@ The following sections provide example logs for the supported API operations. + * Retrieving external account binding credentials (GetAcmeExternalAccountBindingCredentials) + + * Retrieving a certificate (GetCertificate) + @@ -37,0 +66,8 @@ The following sections provide example logs for the supported API operations. + * Listing ACME accounts (ListAcmeAccounts) + + * Listing ACME domain validations (ListAcmeDomainValidations) + + * Listing ACME endpoints (ListAcmeEndpoints) + + * Listing ACME external account bindings (ListAcmeExternalAccountBindings) + @@ -41,0 +78,6 @@ The following sections provide example logs for the supported API operations. + * Listing tags for a resource (ListTagsForResource) + + * Managing an ACME account (ManageAccount) + + * Registering an ACME account (NewAccount) + @@ -48 +90,5 @@ The following sections provide example logs for the supported API operations. - * Retrieving a certificate (GetCertificate) + * Revoking an ACME account (RevokeAcmeAccount) + + * Revoking an ACME external account binding (RevokeAcmeExternalAccountBinding) + + * Revoke a certificate (RevokeCertificate) @@ -51,0 +98,12 @@ The following sections provide example logs for the supported API operations. + * Tagging a resource (TagResource) + + * Removing tags from a resource (UntagResource) + + * Updating an ACME domain validation (UpdateAcmeDomainValidation) + + * Updating an ACME endpoint (UpdateAcmeEndpoint) + + + + +**Data events** @@ -52,0 +111 @@ The following sections provide example logs for the supported API operations. + * Finalizing an order (FinalizeOrder) @@ -53,0 +113 @@ The following sections provide example logs for the supported API operations. + * Downloading a certificate (GetCertificate) @@ -55 +115,22 @@ The following sections provide example logs for the supported API operations. -## Adding tags to a certificate ([AddTagsToCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_AddTagsToCertificate.html)) + * Retrieving the directory (GetDirectory) + + * Retrieving an order (GetOrder) + + * Listing orders (ListOrders) + + * Managing an authorization (ManageAuthorization) + + * Requesting a nonce (NewNonce) + + * Creating an order (NewOrder) + + * Revoking a certificate (RevokeCertificate) + + + + +## Management events + +ACM logs the following operations as CloudTrail management events. Management events are logged by default. + +### Adding tags to a certificate ([AddTagsToCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_AddTagsToCertificate.html)) @@ -97,3 +178 @@ The following CloudTrail example shows the results of a call to the [AddTagsToCe -## Deleting a certificate ([DeleteCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteCertificate.html)) - -The following CloudTrail example shows the results of a call to the [DeleteCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteCertificate.html) API. +### Changing an ACME account key ([ChangeAccountKey](https://docs.aws.amazon.com/acm/latest/APIReference/API_ChangeAccountKey.html)) @@ -100,0 +180 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti +The following CloudTrail example shows a log entry for the `ChangeAccountKey` operation. @@ -102 +181,0 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - { @@ -104 +182,0 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "Records":[ @@ -106 +184 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "eventVersion":"1.04", + "eventVersion": "1.11", @@ -108,3 +186,3 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "type":"IAMUser", - "principalId":"AIDACKCEVSQ6C2EXAMPLE", - "arn":"arn:aws:iam::123456789012:user/Alice", + "type": "Unknown", + "principalId": "anonymous", + "arn": "anonymous", @@ -112,2 +190 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "accessKeyId":"AKIAIOSFODNN7EXAMPLE", - "userName":"Alice" + "userName": "anonymous" @@ -115,3 +192,3 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "eventTime":"2016-03-18T00:00:26Z", - "eventSource":"acm.amazonaws.com", - "eventName":"DeleteCertificate", + "eventTime": "2026-06-10T20:29:57Z", + "eventSource": "acm-acme.amazonaws.com", + "eventName": "ChangeAccountKey", @@ -120 +197 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "userAgent":"aws-cli/1.9.15", + "userAgent": "aws-cli/2.0", @@ -122 +199,2 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/fedcba98-7654-3210-fedc-ba9876543210" + "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", + "innerJws": "EXAMPLE" @@ -124,3 +202,15 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "responseElements":null, - "requestID":"01234567-89ab-cdef-0123-456789abcdef", - "eventID":"01234567-89ab-cdef-0123-456789abcdef", + "responseElements": { + "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222", + "status": "valid", + "orders": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/orders" + }, + "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", + "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222", + "readOnly": false, + "resources": [ + { + "accountId": "123456789012", + "type": "AWS::CertificateManager::AcmeEndpoint", + "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" + } + ], @@ -128 +218,7 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - "recipientAccountId":"123456789012" + "managementEvent": true, + "recipientAccountId": "123456789012", + "eventCategory": "Management", + "tlsDetails": { + "tlsVersion": "TLSv1.3", + "cipherSuite": "TLS_AES_128_GCM_SHA256", + "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws" @@ -130 +225,0 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti - ] @@ -133,5 +228 @@ The following CloudTrail example shows the results of a call to the [DeleteCerti -## Describing a certificate ([DescribeCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html)) - -The following CloudTrail example shows the results of a call to the [DescribeCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html) API. - -###### Note +### Creating an ACME domain validation ([CreateAcmeDomainValidation](https://docs.aws.amazon.com/acm/latest/APIReference/API_CreateAcmeDomainValidation.html)) @@ -139 +230 @@ The following CloudTrail example shows the results of a call to the [DescribeCer -The CloudTrail log for the `DescribeCertificate` operation does not display information about the ACM certificate you specify. You can view information about the certificate by using the console, the AWS Command Line Interface, or the [DescribeCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html) API. +The following CloudTrail example shows a log entry for the `CreateAcmeDomainValidation` operation. @@ -143,3 +234 @@ The CloudTrail log for the `DescribeCertificate` operation does not display info - "Records":[ - { - "eventVersion":"1.04", + "eventVersion": "1.11", @@ -147,3 +236,3 @@ The CloudTrail log for the `DescribeCertificate` operation does not display info - "type":"IAMUser", - "principalId":"AIDACKCEVSQ6C2EXAMPLE", - "arn":"arn:aws:iam::123456789012:user/Alice", + "type": "AssumedRole", + "principalId": "AROAEXAMPLEID:example-session", + "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session", @@ -151,2 +240,8 @@ The CloudTrail log for the `DescribeCertificate` operation does not display info - "accessKeyId":"AKIAIOSFODNN7EXAMPLE", - "userName":"Alice" + "accessKeyId": "ASIAIOSFODNN7EXAMPLE",