AWS acm: Document ACME condition keys and acm:Export condition
Summary
Added explanation that ACME-requested certificates are authorized as standard ACM actions, plus a new acm:Export condition key to restrict creation of exportable public certificates.
Security assessment
Documents IAM condition keys, including acm:Export, that let administrators restrict issuance of exportable public certificates and control ACME authorization. This is security best-practice/authorization guidance, not a fix for a specific vulnerability.
Evidence
+`acm:Export` | [RequestCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html) | String (`ENABLED`, `DISABLED`) | Filter requests based on the export option in the request. Use this condition to restrict the creation of [exportable public certificates](https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html).
Diff
diff --git a/acm/latest/userguide/acm-conditions.md b/acm/latest/userguide/acm-conditions.md index 8daeffe3b..3b76bf8c4 100644 --- a//acm/latest/userguide/acm-conditions.md +++ b//acm/latest/userguide/acm-conditions.md @@ -16,0 +17,2 @@ Combine ACM condition keys with AWS [ global condition keys](https://docs.aws.am +Certificates requested through an ACME endpoint are authorized as standard ACM actions, so these condition keys apply to them as well. The keys available on each action and the values ACM supplies differ from a direct API call. For those values, see [Condition keys for ACME certificate requests](./acm-conditions-acme.html). + @@ -27,0 +30 @@ ACM API operations and supported conditions Condition Key | Supported ACM API Op +`acm:Export` | [RequestCertificate](https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html) | String (`ENABLED`, `DISABLED`) | Filter requests based on the export option in the request. Use this condition to restrict the creation of [exportable public certificates](https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). @@ -274 +277 @@ AWS managed policies -Use service-linked roles +Condition keys for ACME