AWS Private CA now provides detailed certificate issuance logs

AWS Private CA provides detailed certificate issuance logs, recording full certificate contents, issuing CA information, requester IDs, and signing status for each issuance. These events aid compliance audits, certificate inventory, algorithm transition tracking, and issuance failure monitoring. Unlike legacy IssueCertificate API CloudTrail management events, which only provided a certificate ARN upon successful API calls, the new IssueCertificateDetails event captures all X.509 fields and extensions of the certificate to be signed (TBS), along with convenience fields for subject, issuer, serial number, validity, template, and signing algorithm. It logs both successful and failed issuance events, including pre-signing failures like name constraint violations, with failure descriptions. Each event identifies the requester-either the account and IAM principal for direct API calls, or the service principal for certificates issued via AWS Private CA connectors or integrated AWS services. In cross-account setups, events are delivered to the CA owner account. This event is automatically delivered as a CloudTrail management event with no configuration or opt-in required and no additional cost beyond standard AWS CloudTrail charges. CloudTrail can then process these events in real time via Amazon EventBridge or run batch queries with Amazon Athena for certificate auditing, inventory, tracking, and monitoring. This feature is available in all AWS regions where AWS Private CA is offered.

Why it matters

AWS Private CA is a service for managing private certificates. This update enables more detailed tracking of certificate issuance, improving compliance and security management.