[Bug]: Can's issue certificate from a shared private CA about aws-privateca-issuer HOT 6 CLOSED

Ah, Thank you very much @divyansh-gupta it worked like a charm.

from aws-privateca-issuer.

Hi, could you please post the relevant portion of the policy you are using for arn:aws:sts::XXXXXXXX:assumed-role/shared-dev-1-cert-manager/1657793931500012209, and the policy or RAM permission attached to your CA?

And what template type are you issuing with? Cross-account supports a limited set of template types. The plugin picks the template type based off the Usage Type you specify. Check this section in our Readme for information: Mapping Cert-Manager Usage Types to AWS PCA Template Arns.

Thank you.

from aws-privateca-issuer.

Hi @divyansh-gupta , the policy looks like this,

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "awspcaissuer",
"Effect": "Allow",
"Action": [
"acm-pca:IssueCertificate",
"acm-pca:GetCertificate",
"acm-pca:DescribeCertificateAuthority"
],
"Resource": "*"
}
]
}

and RAM permission attached to the CA is the one provided by AWS permission library named AWSRAMDefaultPermissionCertificateAuthority

from aws-privateca-issuer.

Thank you. That RAM policy is:

[
  {
    "Effect": "Allow",
    "Action": [
      "acm-pca:IssueCertificate"
    ],
    "Condition": {
      "StringEquals": {
        "acm-pca:TemplateArn": "arn::acm-pca:::template/EndEntityCertificate/V1"
      }
    }
  },
  {
    "Effect": "Allow",
    "Action": [
      "acm-pca:DescribeCertificateAuthority",
      "acm-pca:GetCertificate",
      "acm-pca:GetCertificateAuthorityCertificate",
      "acm-pca:ListPermissions",
      "acm-pca:ListTags"
    ]
  }
]

Are you issuing a arn::acm-pca:::template/EndEntityCertificate/V1 through the plugin, based off the Mapping Cert-Manager Usage Types to AWS PCA Template Arns section of the README?

from aws-privateca-issuer.

Thanks for your reply @divyansh-gupta . Sorry I didn't get this point. I just installed the cert-manager, then installed this plugin using helm chart and then created the issuer. Do I need to do something else? please suggest.

from aws-privateca-issuer.

Hi @Kumar-shantanu, no problem, happy to help. Each Certificate CRD has an optional usages section, as defined in https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources. The plugin translates those usages to templateArns based off this chart: https://github.com/cert-manager/aws-privateca-issuer#mapping-cert-manager-usage-types-to-aws-pca-template-arns

Your user is authorized to issue an EndEntityCertificate/V1 certificate. The chart shows that you need ClientAuth, ServerAuth usages for that. Here is an example of what you need to add to your Certificate CRD to do that:

Let me know if that works out for you.

from aws-privateca-issuer.