AWS SDK for PHP 3.x (original) (raw)

Client: Aws\PcaConnectorAd\PcaConnectorAdClient

Service ID: pca-connector-ad

Version: 2018-05-10

This page describes the parameters and results for the operations of the PcaConnectorAd (2018-05-10), and shows how to use the Aws\PcaConnectorAd\PcaConnectorAdClientobject to call the described operations. This documentation is specific to the 2018-05-10 API version of the service.

Operation Summary

Each of the following operations can be created from a client using$client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

CreateConnector ( array $params = [] )

Creates a connector between Amazon Web Services Private CA and an Active Directory.

CreateDirectoryRegistration ( array $params = [] )

Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory

CreateServicePrincipalName ( array $params = [] )

Creates a service principal name (SPN) for the service account in Active Directory.

CreateTemplate ( array $params = [] )

Creates an Active Directory compatible certificate template.

CreateTemplateGroupAccessControlEntry ( array $params = [] )

Create a group access control entry.

DeleteConnector ( array $params = [] )

Deletes a connector for Active Directory.

DeleteDirectoryRegistration ( array $params = [] )

Deletes a directory registration.

DeleteServicePrincipalName ( array $params = [] )

Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.

DeleteTemplate ( array $params = [] )

Deletes a template.

DeleteTemplateGroupAccessControlEntry ( array $params = [] )

Deletes a group access control entry.

GetConnector ( array $params = [] )

Lists information about your connector.

GetDirectoryRegistration ( array $params = [] )

A structure that contains information about your directory registration.

GetServicePrincipalName ( array $params = [] )

Lists the service principal name that the connector uses to authenticate with Active Directory.

GetTemplate ( array $params = [] )

Retrieves a certificate template that the connector uses to issue certificates from a private CA.

GetTemplateGroupAccessControlEntry ( array $params = [] )

Retrieves the group access control entries for a template.

ListConnectors ( array $params = [] )

Lists the connectors that you created by using the https://docs.

ListDirectoryRegistrations ( array $params = [] )

Lists the directory registrations that you created by using the https://docs.

ListServicePrincipalNames ( array $params = [] )

Lists the service principal names that the connector uses to authenticate with Active Directory.

ListTagsForResource ( array $params = [] )

Lists the tags, if any, that are associated with your resource.

ListTemplateGroupAccessControlEntries ( array $params = [] )

Lists group access control entries you created.

ListTemplates ( array $params = [] )

Lists the templates, if any, that are associated with a connector.

TagResource ( array $params = [] )

Adds one or more tags to your resource.

UntagResource ( array $params = [] )

Removes one or more tags from your resource.

UpdateTemplate ( array $params = [] )

Update template configuration to define the information included in certificates.

UpdateTemplateGroupAccessControlEntry ( array $params = [] )

Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListConnectors

ListDirectoryRegistrations

ListServicePrincipalNames

ListTemplateGroupAccessControlEntries

ListTemplates

Operations

CreateConnector

result=result = result=client->createConnector([/* ... /]); promise=promise = promise=client->createConnectorAsync([/ ... */]);

Creates a connector between Amazon Web Services Private CA and an Active Directory. You must specify the private CA, directory ID, and security groups.

Parameter Syntax

result=result = result=client->createConnector([ 'CertificateAuthorityArn' => '', // REQUIRED 'ClientToken' => '', 'DirectoryId' => '', // REQUIRED 'Tags' => ['', ...], 'VpcInformation' => [ // REQUIRED 'IpAddressType' => 'IPV4|DUALSTACK', 'SecurityGroupIds' => ['', ...], // REQUIRED ], ]);

Parameter Details

Members

CertificateAuthorityArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) of the certificate authority being used.

ClientToken

Idempotency token.

DirectoryId

Required: Yes

Type: string

The identifier of the Active Directory.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a connector consisting of a key-value pair.

VpcInformation

Required: Yes

Type: VpcInformation structure

Information about your VPC and security groups used with the connector.

Result Syntax

[ 'ConnectorArn' => '', ]

Result Details

Members

ConnectorArn

If successful, the Amazon Resource Name (ARN) of the connector for Active Directory.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

ServiceQuotaExceededException:

Request would cause a service quota to be exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateDirectoryRegistration

result=result = result=client->createDirectoryRegistration([/* ... /]); promise=promise = promise=client->createDirectoryRegistrationAsync([/ ... */]);

Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory

Parameter Syntax

result=result = result=client->createDirectoryRegistration([ 'ClientToken' => '', 'DirectoryId' => '', // REQUIRED 'Tags' => ['', ...], ]);

Parameter Details

Members

ClientToken

Idempotency token.

DirectoryId

Required: Yes

Type: string

The identifier of the Active Directory.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[ 'DirectoryRegistrationArn' => '', ]

Result Details

Members

DirectoryRegistrationArn

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateServicePrincipalName

result=result = result=client->createServicePrincipalName([/* ... /]); promise=promise = promise=client->createServicePrincipalNameAsync([/ ... */]);

Creates a service principal name (SPN) for the service account in Active Directory. Kerberos authentication uses SPNs to associate a service instance with a service sign-in account.

Parameter Syntax

result=result = result=client->createServicePrincipalName([ 'ClientToken' => '', 'ConnectorArn' => '', // REQUIRED 'DirectoryRegistrationArn' => '', // REQUIRED ]);

Parameter Details

Members

ClientToken

Idempotency token.

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes

Type: string

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplate

result=result = result=client->createTemplate([/* ... /]); promise=promise = promise=client->createTemplateAsync([/ ... */]);

Creates an Active Directory compatible certificate template. The connectors issues certificates using these templates based on the requester’s Active Directory group membership.

Parameter Syntax

result=result = result=client->createTemplate([ 'ClientToken' => '', 'ConnectorArn' => '', // REQUIRED 'Definition' => [ // REQUIRED 'TemplateV2' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'PrivateKeyAttributes' => [ // REQUIRED 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV3' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED 'PrivateKeyAttributes' => [ // REQUIRED 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'KeyUsageProperty' => [ // REQUIRED 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV4' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ // REQUIRED 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'RequireSameKeyRenewal' => true || false, 'StrongKeyProtectionRequired' => true || false, 'UseLegacyProvider' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], ], 'Name' => '', // REQUIRED 'Tags' => ['', ...], ]);

Parameter Details

Members

ClientToken

Idempotency token.

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Definition

Required: Yes

Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Name

Required: Yes

Type: string

Name of the template. The template name must be unique.

Tags

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a template consisting of a key-value pair.

Result Syntax

[ 'TemplateArn' => '', ]

Result Details

Members

TemplateArn

If successful, the Amazon Resource Name (ARN) of the template.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

ServiceQuotaExceededException:

Request would cause a service quota to be exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

CreateTemplateGroupAccessControlEntry

result=result = result=client->createTemplateGroupAccessControlEntry([/* ... /]); promise=promise = promise=client->createTemplateGroupAccessControlEntryAsync([/ ... */]);

Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).

Parameter Syntax

result=result = result=client->createTemplateGroupAccessControlEntry([ 'AccessRights' => [ // REQUIRED 'AutoEnroll' => 'ALLOW|DENY', 'Enroll' => 'ALLOW|DENY', ], 'ClientToken' => '', 'GroupDisplayName' => '', // REQUIRED 'GroupSecurityIdentifier' => '', // REQUIRED 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

AccessRights

Required: Yes

Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

ClientToken

Idempotency token.

GroupDisplayName

Required: Yes

Type: string

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Required: Yes

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

ServiceQuotaExceededException:

Request would cause a service quota to be exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteConnector

result=result = result=client->deleteConnector([/* ... /]); promise=promise = promise=client->deleteConnectorAsync([/ ... */]);

Deletes a connector for Active Directory. You must provide the Amazon Resource Name (ARN) of the connector that you want to delete. You can find the ARN by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_ListConnectors action. Deleting a connector does not deregister your directory with Amazon Web Services Private CA. You can deregister your directory by calling the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_DeleteDirectoryRegistration action.

Parameter Syntax

result=result = result=client->deleteConnector([ 'ConnectorArn' => '', // REQUIRED ]);

Parameter Details

Members

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteDirectoryRegistration

result=result = result=client->deleteDirectoryRegistration([/* ... /]); promise=promise = promise=client->deleteDirectoryRegistrationAsync([/ ... */]);

Deletes a directory registration. Deleting a directory registration deauthorizes Amazon Web Services Private CA with the directory.

Parameter Syntax

result=result = result=client->deleteDirectoryRegistration([ 'DirectoryRegistrationArn' => '', // REQUIRED ]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes

Type: string

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteServicePrincipalName

result=result = result=client->deleteServicePrincipalName([/* ... /]); promise=promise = promise=client->deleteServicePrincipalNameAsync([/ ... */]);

Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory.

Parameter Syntax

result=result = result=client->deleteServicePrincipalName([ 'ConnectorArn' => '', // REQUIRED 'DirectoryRegistrationArn' => '', // REQUIRED ]);

Parameter Details

Members

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes

Type: string

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplate

result=result = result=client->deleteTemplate([/* ... /]); promise=promise = promise=client->deleteTemplateAsync([/ ... */]);

Deletes a template. Certificates issued using the template are still valid until they are revoked or expired.

Parameter Syntax

result=result = result=client->deleteTemplate([ 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

DeleteTemplateGroupAccessControlEntry

result=result = result=client->deleteTemplateGroupAccessControlEntry([/* ... /]); promise=promise = promise=client->deleteTemplateGroupAccessControlEntryAsync([/ ... */]);

Deletes a group access control entry.

Parameter Syntax

result=result = result=client->deleteTemplateGroupAccessControlEntry([ 'GroupSecurityIdentifier' => '', // REQUIRED 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

GroupSecurityIdentifier

Required: Yes

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

GetConnector

result=result = result=client->getConnector([/* ... /]); promise=promise = promise=client->getConnectorAsync([/ ... */]);

Lists information about your connector. You specify the connector on input by its ARN (Amazon Resource Name).

Parameter Syntax

result=result = result=client->getConnector([ 'ConnectorArn' => '', // REQUIRED ]);

Parameter Details

Members

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

Result Syntax

[ 'Connector' => [ 'Arn' => '', 'CertificateAuthorityArn' => '', 'CertificateEnrollmentPolicyServerEndpoint' => '', 'CreatedAt' => , 'DirectoryId' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'CA_CERTIFICATE_REGISTRATION_FAILED|DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|INSUFFICIENT_FREE_ADDRESSES|INVALID_SUBNET_IP_PROTOCOL|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND', 'UpdatedAt' => , 'VpcInformation' => [ 'IpAddressType' => 'IPV4|DUALSTACK', 'SecurityGroupIds' => ['', ...], ], ], ]

Result Details

Members

Connector

Type: Connector structure

A structure that contains information about your connector.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

GetDirectoryRegistration

result=result = result=client->getDirectoryRegistration([/* ... /]); promise=promise = promise=client->getDirectoryRegistrationAsync([/ ... */]);

A structure that contains information about your directory registration.

Parameter Syntax

result=result = result=client->getDirectoryRegistration([ 'DirectoryRegistrationArn' => '', // REQUIRED ]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes

Type: string

Result Syntax

[ 'DirectoryRegistration' => [ 'Arn' => '', 'CreatedAt' => , 'DirectoryId' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE', 'UpdatedAt' => , ], ]

Result Details

Members

DirectoryRegistration

Type: DirectoryRegistration structure

The directory registration represents the authorization of the connector service with a directory.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

GetServicePrincipalName

result=result = result=client->getServicePrincipalName([/* ... /]); promise=promise = promise=client->getServicePrincipalNameAsync([/ ... */]);

Lists the service principal name that the connector uses to authenticate with Active Directory.

Parameter Syntax

result=result = result=client->getServicePrincipalName([ 'ConnectorArn' => '', // REQUIRED 'DirectoryRegistrationArn' => '', // REQUIRED ]);

Parameter Details

Members

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

DirectoryRegistrationArn

Required: Yes

Type: string

Result Syntax

[ 'ServicePrincipalName' => [ 'ConnectorArn' => '', 'CreatedAt' => , 'DirectoryRegistrationArn' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|SPN_LIMIT_EXCEEDED|INTERNAL_FAILURE', 'UpdatedAt' => , ], ]

Result Details

Members

ServicePrincipalName

Type: ServicePrincipalName structure

The service principal name that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplate

result=result = result=client->getTemplate([/* ... /]); promise=promise = promise=client->getTemplateAsync([/ ... */]);

Retrieves a certificate template that the connector uses to issue certificates from a private CA.

Parameter Syntax

result=result = result=client->getTemplate([ 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[ 'Template' => [ 'Arn' => '', 'ConnectorArn' => '', 'CreatedAt' => , 'Definition' => [ 'TemplateV2' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'PrivateKeyAttributes' => [ 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV3' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV4' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'RequireSameKeyRenewal' => true || false, 'StrongKeyProtectionRequired' => true || false, 'UseLegacyProvider' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], ], 'Name' => '', 'ObjectIdentifier' => '', 'PolicySchema' => , 'Revision' => [ 'MajorRevision' => , 'MinorRevision' => , ], 'Status' => 'ACTIVE|DELETING', 'UpdatedAt' => , ], ]

Result Details

Members

Template

A certificate template that the connector uses to issue certificates from a private CA.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

GetTemplateGroupAccessControlEntry

result=result = result=client->getTemplateGroupAccessControlEntry([/* ... /]); promise=promise = promise=client->getTemplateGroupAccessControlEntryAsync([/ ... */]);

Retrieves the group access control entries for a template.

Parameter Syntax

result=result = result=client->getTemplateGroupAccessControlEntry([ 'GroupSecurityIdentifier' => '', // REQUIRED 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

GroupSecurityIdentifier

Required: Yes

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[ 'AccessControlEntry' => [ 'AccessRights' => [ 'AutoEnroll' => 'ALLOW|DENY', 'Enroll' => 'ALLOW|DENY', ], 'CreatedAt' => , 'GroupDisplayName' => '', 'GroupSecurityIdentifier' => '', 'TemplateArn' => '', 'UpdatedAt' => , ], ]

Result Details

Members

AccessControlEntry

Type: AccessControlEntry structure

An access control entry allows or denies an Active Directory group from enrolling and/or autoenrolling with a template.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListConnectors

result=result = result=client->listConnectors([/* ... /]); promise=promise = promise=client->listConnectorsAsync([/ ... */]);

Lists the connectors that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateConnector action.

Parameter Syntax

result=result = result=client->listConnectors([ 'MaxResults' => , 'NextToken' => '', ]);

Parameter Details

Members

MaxResults

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[ 'Connectors' => [ [ 'Arn' => '', 'CertificateAuthorityArn' => '', 'CertificateEnrollmentPolicyServerEndpoint' => '', 'CreatedAt' => , 'DirectoryId' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'CA_CERTIFICATE_REGISTRATION_FAILED|DIRECTORY_ACCESS_DENIED|INTERNAL_FAILURE|INSUFFICIENT_FREE_ADDRESSES|INVALID_SUBNET_IP_PROTOCOL|PRIVATECA_ACCESS_DENIED|PRIVATECA_RESOURCE_NOT_FOUND|SECURITY_GROUP_NOT_IN_VPC|VPC_ACCESS_DENIED|VPC_ENDPOINT_LIMIT_EXCEEDED|VPC_RESOURCE_NOT_FOUND', 'UpdatedAt' => , 'VpcInformation' => [ 'IpAddressType' => 'IPV4|DUALSTACK', 'SecurityGroupIds' => ['', ...], ], ], // ... ], 'NextToken' => '', ]

Result Details

Members

Connectors

Type: Array of ConnectorSummary structures

Summary information about each connector you have created.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListDirectoryRegistrations

result=result = result=client->listDirectoryRegistrations([/* ... /]); promise=promise = promise=client->listDirectoryRegistrationsAsync([/ ... */]);

Lists the directory registrations that you created by using the https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateDirectoryRegistration action.

Parameter Syntax

result=result = result=client->listDirectoryRegistrations([ 'MaxResults' => , 'NextToken' => '', ]);

Parameter Details

Members

MaxResults

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[ 'DirectoryRegistrations' => [ [ 'Arn' => '', 'CreatedAt' => , 'DirectoryId' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_RESOURCE_NOT_FOUND|DIRECTORY_NOT_ACTIVE|DIRECTORY_NOT_REACHABLE|DIRECTORY_TYPE_NOT_SUPPORTED|INTERNAL_FAILURE', 'UpdatedAt' => , ], // ... ], 'NextToken' => '', ]

Result Details

Members

DirectoryRegistrations

Type: Array of DirectoryRegistrationSummary structures

Summary information about each directory registration you have created.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListServicePrincipalNames

result=result = result=client->listServicePrincipalNames([/* ... /]); promise=promise = promise=client->listServicePrincipalNamesAsync([/ ... */]);

Lists the service principal names that the connector uses to authenticate with Active Directory.

Parameter Syntax

result=result = result=client->listServicePrincipalNames([ 'DirectoryRegistrationArn' => '', // REQUIRED 'MaxResults' => , 'NextToken' => '', ]);

Parameter Details

Members

DirectoryRegistrationArn

Required: Yes

Type: string

MaxResults

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[ 'NextToken' => '', 'ServicePrincipalNames' => [ [ 'ConnectorArn' => '', 'CreatedAt' => , 'DirectoryRegistrationArn' => '', 'Status' => 'CREATING|ACTIVE|DELETING|FAILED', 'StatusReason' => 'DIRECTORY_ACCESS_DENIED|DIRECTORY_NOT_REACHABLE|DIRECTORY_RESOURCE_NOT_FOUND|SPN_EXISTS_ON_DIFFERENT_AD_OBJECT|SPN_LIMIT_EXCEEDED|INTERNAL_FAILURE', 'UpdatedAt' => , ], // ... ], ]

Result Details

Members

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

ServicePrincipalNames

Type: Array of ServicePrincipalNameSummary structures

The service principal name, if any, that the connector uses to authenticate with Active Directory.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTagsForResource

result=result = result=client->listTagsForResource([/* ... /]); promise=promise = promise=client->listTagsForResourceAsync([/ ... */]);

Lists the tags, if any, that are associated with your resource.

Parameter Syntax

result=result = result=client->listTagsForResource([ 'ResourceArn' => '', // REQUIRED ]);

Parameter Details

Members

ResourceArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Result Syntax

[ 'Tags' => ['', ...], ]

Result Details

Members

Tags

Type: Associative array of custom strings keys (String) to strings

The tags, if any, that are associated with your resource.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplateGroupAccessControlEntries

result=result = result=client->listTemplateGroupAccessControlEntries([/* ... /]); promise=promise = promise=client->listTemplateGroupAccessControlEntriesAsync([/ ... */]);

Lists group access control entries you created.

Parameter Syntax

result=result = result=client->listTemplateGroupAccessControlEntries([ 'MaxResults' => , 'NextToken' => '', 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

MaxResults

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[ 'AccessControlEntries' => [ [ 'AccessRights' => [ 'AutoEnroll' => 'ALLOW|DENY', 'Enroll' => 'ALLOW|DENY', ], 'CreatedAt' => , 'GroupDisplayName' => '', 'GroupSecurityIdentifier' => '', 'TemplateArn' => '', 'UpdatedAt' => , ], // ... ], 'NextToken' => '', ]

Result Details

Members

AccessControlEntries

Type: Array of AccessControlEntrySummary structures

An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ListTemplates

result=result = result=client->listTemplates([/* ... /]); promise=promise = promise=client->listTemplatesAsync([/ ... */]);

Lists the templates, if any, that are associated with a connector.

Parameter Syntax

result=result = result=client->listTemplates([ 'ConnectorArn' => '', // REQUIRED 'MaxResults' => , 'NextToken' => '', ]);

Parameter Details

Members

ConnectorArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

MaxResults

Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Result Syntax

[ 'NextToken' => '', 'Templates' => [ [ 'Arn' => '', 'ConnectorArn' => '', 'CreatedAt' => , 'Definition' => [ 'TemplateV2' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'PrivateKeyAttributes' => [ 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV3' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV4' => [ 'CertificateValidity' => [ 'RenewalPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], 'ValidityPeriod' => [ 'Period' => , 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', ], ], 'EnrollmentFlags' => [ 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ 'Critical' => true || false, 'UsageFlags' => [ 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , ], 'PrivateKeyFlags' => [ 'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'RequireSameKeyRenewal' => true || false, 'StrongKeyProtectionRequired' => true || false, 'UseLegacyProvider' => true || false, ], 'SubjectNameFlags' => [ 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], ], 'Name' => '', 'ObjectIdentifier' => '', 'PolicySchema' => , 'Revision' => [ 'MajorRevision' => , 'MinorRevision' => , ], 'Status' => 'ACTIVE|DELETING', 'UpdatedAt' => , ], // ... ], ]

Result Details

Members

NextToken

Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

Templates

Type: Array of TemplateSummary structures

Custom configuration templates used when issuing a certificate.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

TagResource

result=result = result=client->tagResource([/* ... /]); promise=promise = promise=client->tagResourceAsync([/ ... */]);

Adds one or more tags to your resource.

Parameter Syntax

result=result = result=client->tagResource([ 'ResourceArn' => '', // REQUIRED 'Tags' => ['', ...], // REQUIRED ]);

Parameter Details

Members

ResourceArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

Tags

Required: Yes

Type: Associative array of custom strings keys (String) to strings

Metadata assigned to a directory registration consisting of a key-value pair.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

UntagResource

result=result = result=client->untagResource([/* ... /]); promise=promise = promise=client->untagResourceAsync([/ ... */]);

Removes one or more tags from your resource.

Parameter Syntax

result=result = result=client->untagResource([ 'ResourceArn' => '', // REQUIRED 'TagKeys' => ['', ...], // REQUIRED ]);

Parameter Details

Members

ResourceArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you created the resource.

TagKeys

Required: Yes

Type: Array of strings

Specifies a list of tag keys that you want to remove from the specified resources.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

UpdateTemplate

result=result = result=client->updateTemplate([/* ... /]); promise=promise = promise=client->updateTemplateAsync([/ ... */]);

Update template configuration to define the information included in certificates.

Parameter Syntax

result=result = result=client->updateTemplate([ 'Definition' => [ 'TemplateV2' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'PrivateKeyAttributes' => [ // REQUIRED 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2003|WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV3' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', // REQUIRED 'PrivateKeyAttributes' => [ // REQUIRED 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', // REQUIRED 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'KeyUsageProperty' => [ // REQUIRED 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2008|WINDOWS_SERVER_2008_R2|WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'StrongKeyProtectionRequired' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], 'TemplateV4' => [ 'CertificateValidity' => [ // REQUIRED 'RenewalPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], 'ValidityPeriod' => [ // REQUIRED 'Period' => , // REQUIRED 'PeriodType' => 'HOURS|DAYS|WEEKS|MONTHS|YEARS', // REQUIRED ], ], 'EnrollmentFlags' => [ // REQUIRED 'EnableKeyReuseOnNtTokenKeysetStorageFull' => true || false, 'IncludeSymmetricAlgorithms' => true || false, 'NoSecurityExtension' => true || false, 'RemoveInvalidCertificateFromPersonalStore' => true || false, 'UserInteractionRequired' => true || false, ], 'Extensions' => [ // REQUIRED 'ApplicationPolicies' => [ 'Critical' => true || false, 'Policies' => [ // REQUIRED [ 'PolicyObjectIdentifier' => '', 'PolicyType' => 'ALL_APPLICATION_POLICIES|ANY_PURPOSE|ATTESTATION_IDENTITY_KEY_CERTIFICATE|CERTIFICATE_REQUEST_AGENT|CLIENT_AUTHENTICATION|CODE_SIGNING|CTL_USAGE|DIGITAL_RIGHTS|DIRECTORY_SERVICE_EMAIL_REPLICATION|DISALLOWED_LIST|DNS_SERVER_TRUST|DOCUMENT_ENCRYPTION|DOCUMENT_SIGNING|DYNAMIC_CODE_GENERATOR|EARLY_LAUNCH_ANTIMALWARE_DRIVER|EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|ENCLAVE|ENCRYPTING_FILE_SYSTEM|ENDORSEMENT_KEY_CERTIFICATE|FILE_RECOVERY|HAL_EXTENSION|IP_SECURITY_END_SYSTEM|IP_SECURITY_IKE_INTERMEDIATE|IP_SECURITY_TUNNEL_TERMINATION|IP_SECURITY_USER|ISOLATED_USER_MODE|KDC_AUTHENTICATION|KERNEL_MODE_CODE_SIGNING|KEY_PACK_LICENSES|KEY_RECOVERY|KEY_RECOVERY_AGENT|LICENSE_SERVER_VERIFICATION|LIFETIME_SIGNING|MICROSOFT_PUBLISHER|MICROSOFT_TIME_STAMPING|MICROSOFT_TRUST_LIST_SIGNING|OCSP_SIGNING|OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION|PLATFORM_CERTIFICATE|PREVIEW_BUILD_SIGNING|PRIVATE_KEY_ARCHIVAL|PROTECTED_PROCESS_LIGHT_VERIFICATION|PROTECTED_PROCESS_VERIFICATION|QUALIFIED_SUBORDINATION|REVOKED_LIST_SIGNER|ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION|ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION|ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL|ROOT_LIST_SIGNER|SECURE_EMAIL|SERVER_AUTHENTICATION|SMART_CARD_LOGIN|SPC_ENCRYPTED_DIGEST_RETRY_COUNT|SPC_RELAXED_PE_MARKER_CHECK|TIME_STAMPING|WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION|WINDOWS_HARDWARE_DRIVER_VERIFICATION|WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION|WINDOWS_KITS_COMPONENT|WINDOWS_RT_VERIFICATION|WINDOWS_SOFTWARE_EXTENSION_VERIFICATION|WINDOWS_STORE|WINDOWS_SYSTEM_COMPONENT_VERIFICATION|WINDOWS_TCB_COMPONENT|WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT|WINDOWS_UPDATE', ], // ... ], ], 'KeyUsage' => [ // REQUIRED 'Critical' => true || false, 'UsageFlags' => [ // REQUIRED 'DataEncipherment' => true || false, 'DigitalSignature' => true || false, 'KeyAgreement' => true || false, 'KeyEncipherment' => true || false, 'NonRepudiation' => true || false, ], ], ], 'GeneralFlags' => [ // REQUIRED 'AutoEnrollment' => true || false, 'MachineType' => true || false, ], 'HashAlgorithm' => 'SHA256|SHA384|SHA512', 'PrivateKeyAttributes' => [ // REQUIRED 'Algorithm' => 'RSA|ECDH_P256|ECDH_P384|ECDH_P521', 'CryptoProviders' => ['', ...], 'KeySpec' => 'KEY_EXCHANGE|SIGNATURE', // REQUIRED 'KeyUsageProperty' => [ 'PropertyFlags' => [ 'Decrypt' => true || false, 'KeyAgreement' => true || false, 'Sign' => true || false, ], 'PropertyType' => 'ALL', ], 'MinimalKeyLength' => , // REQUIRED ], 'PrivateKeyFlags' => [ // REQUIRED 'ClientVersion' => 'WINDOWS_SERVER_2012|WINDOWS_SERVER_2012_R2|WINDOWS_SERVER_2016', // REQUIRED 'ExportableKey' => true || false, 'RequireAlternateSignatureAlgorithm' => true || false, 'RequireSameKeyRenewal' => true || false, 'StrongKeyProtectionRequired' => true || false, 'UseLegacyProvider' => true || false, ], 'SubjectNameFlags' => [ // REQUIRED 'RequireCommonName' => true || false, 'RequireDirectoryPath' => true || false, 'RequireDnsAsCn' => true || false, 'RequireEmail' => true || false, 'SanRequireDirectoryGuid' => true || false, 'SanRequireDns' => true || false, 'SanRequireDomainDns' => true || false, 'SanRequireEmail' => true || false, 'SanRequireSpn' => true || false, 'SanRequireUpn' => true || false, ], 'SupersededTemplates' => ['', ...], ], ], 'ReenrollAllCertificateHolders' => true || false, 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

Definition

Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

ReenrollAllCertificateHolders

This setting allows the major version of a template to be increased automatically. All members of Active Directory groups that are allowed to enroll with a template will receive a new certificate issued using that template.

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

UpdateTemplateGroupAccessControlEntry

result=result = result=client->updateTemplateGroupAccessControlEntry([/* ... /]); promise=promise = promise=client->updateTemplateGroupAccessControlEntryAsync([/ ... */]);

Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

Parameter Syntax

result=result = result=client->updateTemplateGroupAccessControlEntry([ 'AccessRights' => [ 'AutoEnroll' => 'ALLOW|DENY', 'Enroll' => 'ALLOW|DENY', ], 'GroupDisplayName' => '', 'GroupSecurityIdentifier' => '', // REQUIRED 'TemplateArn' => '', // REQUIRED ]);

Parameter Details

Members

AccessRights

Type: AccessRights structure

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

GroupDisplayName

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Required: Yes

Type: string

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

Required: Yes

Type: string

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

ValidationException:

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

ResourceNotFoundException:

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

ThrottlingException:

The limit on the number of requests per second was exceeded.

InternalServerException:

The request processing has failed because of an unknown error, exception or failure with an internal server.

ConflictException:

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Shapes

AccessControlEntry

Description

An access control entry allows or denies Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autoenrolling with the template.

Members

AccessRights

Type: AccessRights structure

Permissions to allow or deny an Active Directory group to enroll or autoenroll certificates issued against a template.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessControlEntrySummary

Description

Summary of group access control entries that allow or deny Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autofenrolling with the template.

Members

AccessRights

Type: AccessRights structure

Allow or deny an Active Directory group from enrolling and autoenrolling certificates issued against a template.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was created.

GroupDisplayName

Name of the Active Directory group. This name does not need to match the group name in Active Directory.

GroupSecurityIdentifier

Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".

TemplateArn

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the Access Control Entry was updated.

AccessDeniedException

Description

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your Amazon Web Services Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an Amazon Web Services Organizations service control policy (SCP) that affects your Amazon Web Services account.

Members

Message

Required: Yes

Type: string

AccessRights

Description

Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.

Members

AutoEnroll

Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment

Enroll

Allow or deny an Active Directory group from enrolling certificates issued against a template.

ApplicationPolicies

Description

Application policies describe what the certificate can be used for.

Members

Critical

Marks the application policy extension as critical.

Policies

Required: Yes

Type: Array of ApplicationPolicy structures

Application policies describe what the certificate can be used for.

ApplicationPolicy

Description

Application policies describe what the certificate can be used for.

Members

PolicyObjectIdentifier

The object identifier (OID) of an application policy.

PolicyType

The type of application policy

CertificateValidity

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

RenewalPeriod

Required: Yes

Type: ValidityPeriod structure

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

ValidityPeriod

Required: Yes

Type: ValidityPeriod structure

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

ConflictException

Description

This request cannot be completed for one of the following reasons because the requested resource was being concurrently modified by another request.

Members

Message

Required: Yes

Type: string

ResourceId

Required: Yes

Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes

Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

Connector

Description

Amazon Web Services Private CA Connector for Active Directory is a service that links your Active Directory with Amazon Web Services Private CA. The connector brokers the exchange of certificates from Amazon Web Services Private CA to domain-joined users and machines managed with Active Directory.

Members

Arn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

Certificate enrollment endpoint for Active Directory domain-joined objects reach out to when requesting certificates.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

The identifier of the Active Directory.

Status

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

Additional information about the connector status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

ConnectorSummary

Description

Summary description of the Amazon Web Services Private CA AD connectors belonging to an Amazon Web Services account.

Members

Arn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CertificateAuthorityArn

The Amazon Resource Name (ARN) of the certificate authority being used.

CertificateEnrollmentPolicyServerEndpoint

Certificate enrollment endpoint for Active Directory domain-joined objects to request certificates.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was created.

DirectoryId

The identifier of the Active Directory.

Status

Status of the connector. Status can be creating, active, deleting, or failed.

StatusReason

Additional information about the connector status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the connector was updated.

VpcInformation

Type: VpcInformation structure

Information of the VPC and security group(s) used with the connector.

DirectoryRegistration

Description

The directory registration represents the authorization of the connector service with a directory.

Members

Arn

The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

The identifier of the Active Directory.

Status

Status of the directory registration.

StatusReason

Additional information about the directory registration status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

DirectoryRegistrationSummary

Description

The directory registration represents the authorization of the connector service with the Active Directory.

Members

Arn

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was created.

DirectoryId

The identifier of the Active Directory.

Status

Status of the directory registration.

StatusReason

Additional information about the directory registration status if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the directory registration was updated.

EnrollmentFlagsV2

Description

Template configurations for v2 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

RemoveInvalidCertificateFromPersonalStore

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV3

Description

Template configurations for v3 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

RemoveInvalidCertificateFromPersonalStore

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

EnrollmentFlagsV4

Description

Template configurations for v4 template schema.

Members

EnableKeyReuseOnNtTokenKeysetStorageFull

Allow renewal using the same key.

IncludeSymmetricAlgorithms

Include symmetric algorithms allowed by the subject.

NoSecurityExtension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

RemoveInvalidCertificateFromPersonalStore

Delete expired or revoked certificates instead of archiving them.

UserInteractionRequired

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

ExtensionsV2

Description

Certificate extensions for v2 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes

Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV3

Description

Certificate extensions for v3 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes

Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

ExtensionsV4

Description

Certificate extensions for v4 template schema

Members

ApplicationPolicies

Type: ApplicationPolicies structure

Application policies specify what the certificate is used for and its purpose.

KeyUsage

Required: Yes

Type: KeyUsage structure

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

GeneralFlagsV2

Description

General flags for v2 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users.

GeneralFlagsV3

Description

General flags for v3 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

GeneralFlagsV4

Description

General flags for v4 template schema that defines if the template is for a machine or a user and if the template can be issued using autoenrollment.

Members

AutoEnrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

MachineType

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

InternalServerException

Description

The request processing has failed because of an unknown error, exception or failure with an internal server.

Members

Message

Required: Yes

Type: string

KeyUsage

Description

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

Critical

Sets the key usage extension to critical.

UsageFlags

Required: Yes

Type: KeyUsageFlags structure

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

KeyUsageFlags

Description

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Members

DataEncipherment

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

DigitalSignature

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

KeyAgreement

KeyAgreement is asserted when the subject public key is used for key agreement.

KeyEncipherment

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

NonRepudiation

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

KeyUsageProperty

Description

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

Members

PropertyFlags

Type: KeyUsagePropertyFlags structure

You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both.

PropertyType

You can specify all key usages using property type ALL. You can use property type or property flags but not both.

KeyUsagePropertyFlags

Description

Specifies key usage.

Members

Decrypt

Allows key for encryption and decryption.

KeyAgreement

Allows key exchange without encryption.

Sign

Allow key use for digital signature.

PrivateKeyAttributesV2

Description

Defines the attributes of the private key.

Members

CryptoProviders

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes

Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

MinimalKeyLength

Set the minimum key length of the private key.

PrivateKeyAttributesV3

Description

Defines the attributes of the private key.

Members

Algorithm

Required: Yes

Type: string

Defines the algorithm used to generate the private key.

CryptoProviders

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes

Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

Required: Yes

Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

Set the minimum key length of the private key.

PrivateKeyAttributesV4

Description

Defines the attributes of the private key.

Members

Algorithm

Defines the algorithm used to generate the private key.

CryptoProviders

Defines the cryptographic providers used to generate the private key.

KeySpec

Required: Yes

Type: string

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

KeyUsageProperty

Type: KeyUsageProperty structure

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

MinimalKeyLength

Set the minimum key length of the private key.

PrivateKeyFlagsV2

Description

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

Members

ClientVersion

Required: Yes

Type: string

Defines the minimum client compatibility.

ExportableKey

Allows the private key to be exported.

StrongKeyProtectionRequired

Require user input when using the private key for enrollment.

PrivateKeyFlagsV3

Description

Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used.

Members

ClientVersion

Required: Yes

Type: string

Defines the minimum client compatibility.

ExportableKey

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

StrongKeyProtectionRequired

Requirer user input when using the private key for enrollment.

PrivateKeyFlagsV4

Description

Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key.

Members

ClientVersion

Required: Yes

Type: string

Defines the minimum client compatibility.

ExportableKey

Allows the private key to be exported.

RequireAlternateSignatureAlgorithm

Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

RequireSameKeyRenewal

Renew certificate using the same private key.

StrongKeyProtectionRequired

Require user input when using the private key for enrollment.

UseLegacyProvider

Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers.

ResourceNotFoundException

Description

The operation tried to access a nonexistent resource. The resource might not be specified correctly, or its status might not be ACTIVE.

Members

Message

Required: Yes

Type: string

ResourceId

Required: Yes

Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes

Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServicePrincipalName

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.html.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

Status

The status of a service principal name.

StatusReason

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was updated.

ServicePrincipalNameSummary

Description

The service principal name that the connector uses to authenticate with Active Directory.

Members

ConnectorArn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the service principal name was created.

DirectoryRegistrationArn

Status

The status of a service principal name.

StatusReason

Additional information for the status of a service principal name if the status is failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

Time when the service principal name was updated.

ServiceQuotaExceededException

Description

Request would cause a service quota to be exceeded.

Members

Message

Required: Yes

Type: string

QuotaCode

Required: Yes

Type: string

The code associated with the service quota.

ResourceId

Required: Yes

Type: string

The identifier of the Amazon Web Services resource.

ResourceType

Required: Yes

Type: string

The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName, or DirectoryRegistration.

ServiceCode

Required: Yes

Type: string

Identifies the originating service.

SubjectNameFlagsV2

Description

Information to include in the subject name and alternate subject name of the certificate. The subject name can be common name, directory path, DNS as common name, or left blank. You can optionally include email to the subject name for user templates. If you leave the subject name blank then you must set a subject alternate name. The subject alternate name (SAN) can include globally unique identifier (GUID), DNS, domain DNS, email, service principal name (SPN), and user principal name (UPN). You can leave the SAN blank. If you leave the SAN blank, then you must set a subject name.

Members

RequireCommonName

Include the common name in the subject name.

RequireDirectoryPath

Include the directory path in the subject name.

RequireDnsAsCn

Include the DNS as common name in the subject name.

RequireEmail

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Include the DNS in the subject alternate name.

SanRequireDomainDns

Include the domain DNS in the subject alternate name.

SanRequireEmail

Include the subject's email in the subject alternate name.

SanRequireSpn

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV3

Description

Information to include in the subject name and alternate subject name of the certificate. The subject name can be common name, directory path, DNS as common name, or left blank. You can optionally include email to the subject name for user templates. If you leave the subject name blank then you must set a subject alternate name. The subject alternate name (SAN) can include globally unique identifier (GUID), DNS, domain DNS, email, service principal name (SPN), and user principal name (UPN). You can leave the SAN blank. If you leave the SAN blank, then you must set a subject name.

Members

RequireCommonName

Include the common name in the subject name.

RequireDirectoryPath

Include the directory path in the subject name.

RequireDnsAsCn

Include the DNS as common name in the subject name.

RequireEmail

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Include the DNS in the subject alternate name.

SanRequireDomainDns

Include the domain DNS in the subject alternate name.

SanRequireEmail

Include the subject's email in the subject alternate name.

SanRequireSpn

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Include the user principal name (UPN) in the subject alternate name.

SubjectNameFlagsV4

Description

Information to include in the subject name and alternate subject name of the certificate. The subject name can be common name, directory path, DNS as common name, or left blank. You can optionally include email to the subject name for user templates. If you leave the subject name blank then you must set a subject alternate name. The subject alternate name (SAN) can include globally unique identifier (GUID), DNS, domain DNS, email, service principal name (SPN), and user principal name (UPN). You can leave the SAN blank. If you leave the SAN blank, then you must set a subject name.

Members

RequireCommonName

Include the common name in the subject name.

RequireDirectoryPath

Include the directory path in the subject name.

RequireDnsAsCn

Include the DNS as common name in the subject name.

RequireEmail

Include the subject's email in the subject name.

SanRequireDirectoryGuid

Include the globally unique identifier (GUID) in the subject alternate name.

SanRequireDns

Include the DNS in the subject alternate name.

SanRequireDomainDns

Include the domain DNS in the subject alternate name.

SanRequireEmail

Include the subject's email in the subject alternate name.

SanRequireSpn

Include the service principal name (SPN) in the subject alternate name.

SanRequireUpn

Include the user principal name (UPN) in the subject alternate name.

Template

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Name

Name of the templates. Template names must be unique.

ObjectIdentifier

Object identifier of a template.

PolicySchema

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

Type: TemplateRevision structure

The version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateDefinition

Description

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Members

TemplateV2

Type: TemplateV2 structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

TemplateV3

Type: TemplateV3 structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

TemplateV4

Type: TemplateV4 structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

TemplateRevision

Description

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Members

MajorRevision

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

MinorRevision

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

TemplateSummary

Description

An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership.

Members

Arn

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

ConnectorArn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

CreatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was created.

Definition

Type: TemplateDefinition structure

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Name

Name of the template. The template name must be unique.

ObjectIdentifier

Object identifier of a template.

PolicySchema

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

Revision

Type: TemplateRevision structure

The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Status

Status of the template. Status can be creating, active, deleting, or failed.

UpdatedAt

Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time that the template was updated.

TemplateV2

Description

v2 template schema that uses Legacy Cryptographic Providers.

Members

CertificateValidity

Required: Yes

Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes

Type: EnrollmentFlagsV2 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes

Type: ExtensionsV2 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes

Type: GeneralFlagsV2 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

PrivateKeyAttributes

Required: Yes

Type: PrivateKeyAttributesV2 structure

Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers.

PrivateKeyFlags

Required: Yes

Type: PrivateKeyFlagsV2 structure

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

SubjectNameFlags

Required: Yes

Type: SubjectNameFlagsV2 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

List of templates in Active Directory that are superseded by this template.

TemplateV3

Description

v3 template schema that uses Key Storage Providers.

Members

CertificateValidity

Required: Yes

Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes

Type: EnrollmentFlagsV3 structure

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes

Type: ExtensionsV3 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes

Type: GeneralFlagsV3 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

Required: Yes

Type: string

Specifies the hash algorithm used to hash the private key.

PrivateKeyAttributes

Required: Yes

Type: PrivateKeyAttributesV3 structure

Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers.

PrivateKeyFlags

Required: Yes

Type: PrivateKeyFlagsV3 structure

Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used.

SubjectNameFlags

Required: Yes

Type: SubjectNameFlagsV3 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

List of templates in Active Directory that are superseded by this template.

TemplateV4

Description

v4 template schema that can use either Legacy Cryptographic Providers or Key Storage Providers.

Members

CertificateValidity

Required: Yes

Type: CertificateValidity structure

Certificate validity describes the validity and renewal periods of a certificate.

EnrollmentFlags

Required: Yes

Type: EnrollmentFlagsV4 structure

Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates.

Extensions

Required: Yes

Type: ExtensionsV4 structure

Extensions describe the key usage extensions and application policies for a template.

GeneralFlags

Required: Yes

Type: GeneralFlagsV4 structure

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

HashAlgorithm

Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers.

PrivateKeyAttributes

Required: Yes

Type: PrivateKeyAttributesV4 structure

Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags.

PrivateKeyFlags

Required: Yes

Type: PrivateKeyFlagsV4 structure

Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key.

SubjectNameFlags

Required: Yes

Type: SubjectNameFlagsV4 structure

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

SupersededTemplates

List of templates in Active Directory that are superseded by this template.

ThrottlingException

Description

The limit on the number of requests per second was exceeded.

Members

Message

Required: Yes

Type: string

QuotaCode

The code associated with the quota.

ServiceCode

Identifies the originating service.

ValidationException

Description

An input validation error occurred. For example, invalid characters in a template name, or if a pagination token is invalid.

Members

Message

Required: Yes

Type: string

Reason

The reason for the validation error. This won't be return for every validation exception.

ValidityPeriod

Description

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in hours, days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Members

Period

Required: Yes

Type: long (int|float)

The numeric value for the validity period.

PeriodType

Required: Yes

Type: string

The unit of time. You can select hours, days, weeks, months, and years.

VpcInformation

Description

Information about your VPC and security groups used with the connector.

Members

IpAddressType

The VPC IP address type.

SecurityGroupIds

Required: Yes

Type: Array of strings

The security groups used with the connector. You can use a maximum of 4 security groups with a connector.