- [Instructor] Hey everyone.
Welcome to the technical demo,
where we'll be covering how you can achieve least privilege
and separation of duties while using AWS ACM Private CA.
Today, we'll be looking at how to implement
some of the use cases that we covered
in the conceptual demo, using the AWS management console,
as well as the command line interface.
We'll start in the AWS SSO console,
where we will click the dropdown
and select the account that we want to assume a role in.
As you can see, we have three roles,
the certificate authority admin, the certificate importer,
and the certificate signer/issuer.
To make it easier to follow along
with these different roles,
I have included the IAM policy on the right side
of the screen, which is the permissions document
that reflects what each role is capable of doing in AWS.
Whenever I change the active permissions and use,
you will see a different policy that reflects
the current role we are using.
First, we're going to assume
the certificate authority admin role, using AWS SSO.
This role will grant us permissions
to create the CA.
I'm going to be creating the CA
in the Canada central region.
So I'm going to verify I'm in the proper region.
And also verify that I have assumed the proper role,
which is the certificate authority admin role.
Next, I'm going to navigate
to the certificate manager service.
If you do not see the ACM service,
please search for it using the search bar.
On the certificate manager page,
you wanna scroll to the bottom and click create a Private CA
to access the private certificate authority service.
You'll be presented with several fields that you can fill
out to configure your certificate authority.
To save time, I'm going to fill out these fields
on my own and meet you back here once I've done that.
If you'd like more details
on how to configure a certificate authority,
be sure to check out my colleagues' videos,
where they go more into depth on those topics.
You can find those links at the end of this video,
or in the description.
If you're following along with this video,
please note that there is a $400 a month charge
for each CA that you create.
The role that we're currently using is the only role
with the permissions to create a certificate authority.
Next, we'll demonstrate that this role does not
have the permissions to activate the certificate authority
by installing a certificate.
When we attempt to do so,
we're met with an error message from AWS IAM,
indicating that we do not have the permission
to get a certificate authority CSR.
If we review the IAM policy document,
you'll see that that permission does not exist
in this IAM policy.
Let's inspect the certificate authority,
and verify that it is not in a state
that can currently issue certificates.
As we can see, the status says pending certificate.
And it says that there is an action required.
Also, take note of the ARN
of the newly created certificate authority,
as we will need this for our command line operations.
To save time, I'm going to set the ARN
as an environment variable, which I'm calling CA ARN.
I will be referring to this environment variable
as I issue AWS CLI calls,
to make it easier for you to read.
We're going to return to AWS SSO,
and retrieve command line credentials
as environment variables
that we'll be using for our CLI calls.
We will also launch a new session using
the same permissions, using the management console.
Jumping back into the management console,
we're going to attempt to delete this certificate authority.
As you can see with our new permissions shown
on the right side, we do not have the permission to do so.
So we should receive an error message from AWS IAM.
Let's test our permissions,
and use the list certificate authorities call
using the AWS CLI.
Make sure to set the proper region before running this call.
As we can see, this returns a certificate authority
with an ARN indicating CA central one,
which is the Canadian region.
This means that we've selected the right region
to issue our certificate.
First, I'm going to print the environment variable
that we set before,
to make sure that our proper CA ARN has been stored
in an environment variable.
I'm going to update this command
to use that environment variable
as the certificate authority ARN.
What this command does,
is it creates a certificate authority CSR,
which can then be signed with an issue certificate command.
Let's view the new CSR.
Next, we're going to use open SSL to encode this new CSR
as a base 64 format.
This is necessary to transmit it using
the issue certificate operation.
Observe as the previous CSR is now shown
in a new base 64 encoded format.
Using the CA signer and issuer role,
we will use the ACM issue certificate command,
supplying the certificate authority ARN, the CSR,
and a signing algorithm that is used during the signing.
We also need to specify a template ARN,
which is the way that the CA will be signing the cert.
You can view a full list of supported templates
using the ACM Private CA documentation,
as well as reviewing my colleague's video
on how templates work.
You will also supply validity information
for how long a certificate should be valid.
In this case, we're using a value of 10 years.
Lastly, there is an item potency token supplied,
so that multiple API calls do not result
in unwanted changes.
Once we run this API call,
we will be storing the output in the certificate ARN file.
Let's take a look at that now.
As you can see, there's an ARN,
which specifies exactly which certificate has been produced
from the previous operation.
We will now retrieve the certificate
that we've created using
the ACM PCA get certificate command,
supplying the certificate authority ARN,
as well as the certificate ARN, to retrieve the certificate.
Let's look at the certificate that we've just downloaded.
Now, we will base and code the certificate
that we've downloaded,
so we're able to import it successfully
into the certificate authority.
Let's take a look and make sure
that our operation was successful.
We will now return to AWS SSO,
and load the permissions necessary
for the certificate importer role into our command line.
Let's view the AWS management console
using the certificate importer role.
Under our CA,
we can see that the status is still pending certificate,
and there's still an action required
to make this certificate authority operational.
Using the AWS ACM import certificate
authority certificate command,
and specifying the certificate authority ARN,
as well as the certificate file,
we are able to successfully import our signed certificate
into the certificate authority.
As we refresh the page,
we will see that the status is now active,
and the certificate has been installed successfully.
The CA is now in a state where it is able
to issue private certificates.
In addition to carefully managing the permissions involved
in the certificate authority setup process,
I would also recommend the use of service control policies,
event-based detections,
and other AWS security best practices,
to better implement least privilege
and protect your AWS environment.
Thanks for joining me as we reviewed
how to set up ACM Private CA,
using least privilege and separation of duties.
I hope this demo is helpful,
and I invite you to check out additional videos
on ACM Private CA, as well as review our documentation
for how Private CA can help you with your certificate needs.