Share your ACM Private CA cross-account
Tags: aws, security, devops
Published: 2021-01-05 13:31:59


A few weeks ago aws launched a new feature to [share a Private CA](https://aws.amazon.com/about-aws/whats-new/2020/08/aws-certificate-manager-private-certificate-authority-supports-private-ca-sharing/) with any AWS account or within your organization. This feature helps you to save costs because you just need to deploy one CA per organization. Since the one Private CA costs $400 per month this is a huge saving. Additionally this feature helps you secure certificates because each account the Private CA is shared with creates it's own certificate and remains in full control of said certificate. The key "lives" in the certificate-creation-account and is fully protected there.
In this post I will show you how to automate the sharing of the Private CA plus how to use it in the shared accounts.




### Architecture  

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/e10zov1qd8w5wo2dysiy.png)

❗️ The shared ACM-PCA is also working for [Amazon Managed Streaming for Apache Kafka (Amazon MSK)](https://aws.amazon.com/en/msk/) - but only via API - the shared ACM-PCA is not shown in the AWS Console.

### Prerequisites
1. ACM-PCA must be deployed
2. [All Features of your AWS Organizations must be enabled](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html) 
2. RAM sharing within your AWS Organization must be enabled </br>
    How to enable this:
    1. Log in to the Organization Master Account with a role or user with permissions to perform ACM and AWS RAM operations in both the central and shared accounts.
    2. Navigate to the **AWS Resource Access Manager** service.
    3. Click on **Settings** on the left menu option.
    4. Enable the feature by checking the **Enable sharing within your AWS Organization** option.

### Deployment of the RAM resource in the central AWS Account
1. Log in to the MPA and switch to the account where the ACM-PCA is deployed.
2. Switch to the Region (e.g.: **eu-central-1**)
3. Open the **CloudFormation** service console
4. Select **Create Stack** - **Upload a template file**; Click **Choose file** and pick the following file: **[001-aws-shared_acm-pca.json](files/001-aws-shared_acm-pca.json)**
6. Click **Next**; Enter the following parameters:

Key | Value | 
--- | --- | 
AWSOrganizationId | *eg: o-xyz123* |
OrganizationMasterAccountId | *Account Id of the Organization Master Account*  | 
AcmPcaArn | *arn of the Private ACM you want to share* | 

</br>

8. Click **Next**; Check: *"I acknowledge that AWS CloudFormation might create IAM resources."* and **Submit**

⚠️ *Side note: If you are sharing a resource using RAM with the whole Organization you don't need to accept the invation in the target Account.*

### How to request a new certificate from the shared private CA using console
1. Log in to an Organization account where the ACM-PCA is being shared with and go to the **Certificate Manager** console
2. Choose **Request a certificate**.
3. Select the option **Request a private certificate**, then choose **Request a certificate**.
4. For CA, select **Shared-Private-CA**, and then click **Next**.
5. For **Add domain names**, add the domain *www.privatedomain.com* , and click **Next**.
6. Choose **Review and request**, confirm it and then click **Confirm and request**.
7. You can now see your new ACM certificate, issued by the *Shared-Private-CA* in your account.


### How to request a new certificate from the shared private CA using cli

1. Request certificate

```cli

aws acm request-certificate –-domain-name www.privatedomain.com --certificate-authority-arn arn:aws:acm-pca:region:111122223333:certificate-authority/123456-xyz123 --validation-method DNS

```