Skip to content

Commit 92be7b8

Browse files
author
AWS
committed
Payment Cryptography Control Plane Update: Add support for certificates to be signed by 3rd party certificate authorities. New API GetCertificateSigningRequest API and support for providing certificates at run-time for tr-34 import/export
1 parent fb8f93a commit 92be7b8

File tree

2 files changed

+174
-4
lines changed

2 files changed

+174
-4
lines changed

‎.changes/next-release/feature-PaymentCryptographyControlPlane-856aa3c.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Payment Cryptography Control Plane",
4+
"contributor": "",
5+
"description": "Add support for certificates to be signed by 3rd party certificate authorities. New API GetCertificateSigningRequest API and support for providing certificates at run-time for tr-34 import/export"
6+
}

‎services/paymentcryptography/src/main/resources/codegen-resources/service-2.json‎

Lines changed: 168 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,24 @@
190190
],
191191
"documentation":"<p>Gets the Amazon Web Services Payment Cryptography key associated with the alias.</p> <p> <b>Cross-account use:</b> This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateAlias.html\">CreateAlias</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_DeleteAlias.html\">DeleteAlias</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ListAliases.html\">ListAliases</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_UpdateAlias.html\">UpdateAlias</a> </p> </li> </ul>"
192192
},
193+
"GetCertificateSigningRequest":{
194+
"name":"GetCertificateSigningRequest",
195+
"http":{
196+
"method":"POST",
197+
"requestUri":"/"
198+
},
199+
"input":{"shape":"GetCertificateSigningRequestInput"},
200+
"output":{"shape":"GetCertificateSigningRequestOutput"},
201+
"errors":[
202+
{"shape":"ServiceUnavailableException"},
203+
{"shape":"ValidationException"},
204+
{"shape":"AccessDeniedException"},
205+
{"shape":"ResourceNotFoundException"},
206+
{"shape":"ThrottlingException"},
207+
{"shape":"InternalServerException"}
208+
],
209+
"documentation":"<p>Used to retrieve the public key for a keypair.</p>"
210+
},
193211
"GetDefaultKeyReplicationRegions":{
194212
"name":"GetDefaultKeyReplicationRegions",
195213
"http":{
@@ -564,6 +582,90 @@
564582
"type":"boolean",
565583
"box":true
566584
},
585+
"CertificateSigningRequestType":{
586+
"type":"string",
587+
"max":32768,
588+
"min":1,
589+
"pattern":"[^\\[;\\]<>]+",
590+
"sensitive":true
591+
},
592+
"CertificateSubjectType":{
593+
"type":"structure",
594+
"required":["CommonName"],
595+
"members":{
596+
"CommonName":{
597+
"shape":"CertificateSubjectTypeCommonNameString",
598+
"documentation":"<p>Common Name to be used in the certificate signing request</p>"
599+
},
600+
"OrganizationUnit":{
601+
"shape":"CertificateSubjectTypeOrganizationUnitString",
602+
"documentation":"<p>Organization Unit to be used in the certificate signing request</p>"
603+
},
604+
"Organization":{
605+
"shape":"CertificateSubjectTypeOrganizationString",
606+
"documentation":"<p>Organization to be used in the certificate signing request</p>"
607+
},
608+
"City":{
609+
"shape":"CertificateSubjectTypeCityString",
610+
"documentation":"<p>City to be used in the certificate signing request</p>"
611+
},
612+
"Country":{
613+
"shape":"CertificateSubjectTypeCountryString",
614+
"documentation":"<p>Country to be used in the certificate signing request</p>"
615+
},
616+
"StateOrProvince":{
617+
"shape":"CertificateSubjectTypeStateOrProvinceString",
618+
"documentation":"<p>State Or Province to be used in the certificate signing request</p>"
619+
},
620+
"EmailAddress":{
621+
"shape":"CertificateSubjectTypeEmailAddressString",
622+
"documentation":"<p>Email to be used in the certificate signing request</p>"
623+
}
624+
},
625+
"documentation":"<p>Metadata used in generating the CSR</p>"
626+
},
627+
"CertificateSubjectTypeCityString":{
628+
"type":"string",
629+
"max":128,
630+
"min":1,
631+
"pattern":"[A-Za-z]+"
632+
},
633+
"CertificateSubjectTypeCommonNameString":{
634+
"type":"string",
635+
"max":64,
636+
"min":1,
637+
"pattern":"[A-Za-z]+"
638+
},
639+
"CertificateSubjectTypeCountryString":{
640+
"type":"string",
641+
"max":2,
642+
"min":2,
643+
"pattern":"[A-Za-z]+"
644+
},
645+
"CertificateSubjectTypeEmailAddressString":{
646+
"type":"string",
647+
"max":128,
648+
"min":1,
649+
"pattern":"[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)*"
650+
},
651+
"CertificateSubjectTypeOrganizationString":{
652+
"type":"string",
653+
"max":64,
654+
"min":1,
655+
"pattern":"[A-Za-z]+"
656+
},
657+
"CertificateSubjectTypeOrganizationUnitString":{
658+
"type":"string",
659+
"max":64,
660+
"min":1,
661+
"pattern":"[A-Za-z]+"
662+
},
663+
"CertificateSubjectTypeStateOrProvinceString":{
664+
"type":"string",
665+
"max":128,
666+
"min":1,
667+
"pattern":"[A-Za-z]+"
668+
},
567669
"CertificateType":{
568670
"type":"string",
569671
"max":32768,
@@ -943,7 +1045,6 @@
9431045
"required":[
9441046
"CertificateAuthorityPublicKeyIdentifier",
9451047
"WrappingKeyCertificate",
946-
"ExportToken",
9471048
"KeyBlockFormat"
9481049
],
9491050
"members":{
@@ -959,6 +1060,14 @@
9591060
"shape":"ExportTokenId",
9601061
"documentation":"<p>The export token to initiate key export from Amazon Web Services Payment Cryptography. It also contains the signing key certificate that will sign the wrapped key during TR-34 key block generation. Call <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetParametersForExport.html\">GetParametersForExport</a> to receive an export token. It expires after 30 days. You can use the same export token to export multiple keys from the same service account.</p>"
9611062
},
1063+
"SigningKeyIdentifier":{
1064+
"shape":"KeyArnOrKeyAliasType",
1065+
"documentation":"<p>Key Identifier used for signing the export key</p>"
1066+
},
1067+
"SigningKeyCertificate":{
1068+
"shape":"CertificateType",
1069+
"documentation":"<p>Certificate used for signing the export key</p>"
1070+
},
9621071
"KeyBlockFormat":{
9631072
"shape":"Tr34KeyBlockFormat",
9641073
"documentation":"<p>The format of key block that Amazon Web Services Payment Cryptography will use during key export.</p>"
@@ -994,6 +1103,38 @@
9941103
}
9951104
}
9961105
},
1106+
"GetCertificateSigningRequestInput":{
1107+
"type":"structure",
1108+
"required":[
1109+
"KeyIdentifier",
1110+
"SigningAlgorithm",
1111+
"CertificateSubject"
1112+
],
1113+
"members":{
1114+
"KeyIdentifier":{
1115+
"shape":"KeyArnOrKeyAliasType",
1116+
"documentation":"<p>Asymmetric key used for generating the certificate signing request</p>"
1117+
},
1118+
"SigningAlgorithm":{
1119+
"shape":"SigningAlgorithmType",
1120+
"documentation":"<p>Algorithm used to generate the certificate signing request</p>"
1121+
},
1122+
"CertificateSubject":{
1123+
"shape":"CertificateSubjectType",
1124+
"documentation":"<p>Certificate subject data</p>"
1125+
}
1126+
}
1127+
},
1128+
"GetCertificateSigningRequestOutput":{
1129+
"type":"structure",
1130+
"required":["CertificateSigningRequest"],
1131+
"members":{
1132+
"CertificateSigningRequest":{
1133+
"shape":"CertificateSigningRequestType",
1134+
"documentation":"<p>Certificate signing request</p>"
1135+
}
1136+
}
1137+
},
9971138
"GetDefaultKeyReplicationRegionsInput":{
9981139
"type":"structure",
9991140
"members":{},
@@ -1329,7 +1470,6 @@
13291470
"required":[
13301471
"CertificateAuthorityPublicKeyIdentifier",
13311472
"SigningKeyCertificate",
1332-
"ImportToken",
13331473
"WrappedKeyBlock",
13341474
"KeyBlockFormat"
13351475
],
@@ -1346,6 +1486,14 @@
13461486
"shape":"ImportTokenId",
13471487
"documentation":"<p>The import token that initiates key import using the asymmetric TR-34 key exchange method into Amazon Web Services Payment Cryptography. It expires after 30 days. You can use the same import token to import multiple keys to the same service account.</p>"
13481488
},
1489+
"WrappingKeyIdentifier":{
1490+
"shape":"KeyArnOrKeyAliasType",
1491+
"documentation":"<p>Key Identifier used for unwrapping the import key</p>"
1492+
},
1493+
"WrappingKeyCertificate":{
1494+
"shape":"CertificateType",
1495+
"documentation":"<p>Key Identifier used for unwrapping the import key</p>"
1496+
},
13491497
"WrappedKeyBlock":{
13501498
"shape":"Tr34WrappedKeyBlock",
13511499
"documentation":"<p>The TR-34 wrapped key block to import.</p>"
@@ -1704,7 +1852,10 @@
17041852
"shape":"Boolean",
17051853
"documentation":"<p>Specifies whether the key is enabled. </p>"
17061854
},
1707-
"MultiRegionKeyType":{"shape":"MultiRegionKeyType"},
1855+
"MultiRegionKeyType":{
1856+
"shape":"MultiRegionKeyType",
1857+
"documentation":"<p>Indicates whether this key is a multi-region key and its role in the multi-region key hierarchy.</p> <p>Multi-region keys allow the same key material to be used across multiple Amazon Web Services Regions. This field specifies whether the key is a primary key (which can be replicated to other regions) or a replica key (which is a copy of a primary key in another region).</p>"
1858+
},
17081859
"PrimaryRegion":{"shape":"Region"}
17091860
},
17101861
"documentation":"<p>Metadata about an Amazon Web Services Payment Cryptography key.</p>"
@@ -1928,7 +2079,10 @@
19282079
"type":"structure",
19292080
"required":["Status"],
19302081
"members":{
1931-
"Status":{"shape":"KeyReplicationState"},
2082+
"Status":{
2083+
"shape":"KeyReplicationState",
2084+
"documentation":"<p>The current status of key replication in this region.</p> <p>This field indicates whether the key replication is in progress, completed successfully, or has encountered an error. Possible values include states such as SYNCRHONIZED, IN_PROGRESS, DELETE_IN_PROGRESS, or FAILED. This provides visibility into the replication process for monitoring and troubleshooting purposes.</p>"
2085+
},
19322086
"StatusMessage":{
19332087
"shape":"String",
19342088
"documentation":"<p>A message that provides additional information about the current replication status of the key.</p> <p>This field contains details about any issues or progress updates related to key replication operations. It may include information about replication failures, synchronization status, or other operational details.</p>"
@@ -2014,6 +2168,16 @@
20142168
"min":2,
20152169
"pattern":"(?:[0-9a-fA-F][0-9a-fA-F])+"
20162170
},
2171+
"SigningAlgorithmType":{
2172+
"type":"string",
2173+
"documentation":"<p>Defines the Algorithm used to generate the certificate signing request</p>",
2174+
"enum":[
2175+
"SHA224",
2176+
"SHA256",
2177+
"SHA384",
2178+
"SHA512"
2179+
]
2180+
},
20172181
"StartKeyUsageInput":{
20182182
"type":"structure",
20192183
"required":["KeyIdentifier"],

0 commit comments

Comments
 (0)