Importing a signed certificate into ACM PCA for a CA

Question

Pulumi · Accepted Answer

To import a signed certificate into AWS Certificate Manager Private Certificate Authority (ACM PCA) for a Certificate Authority (CA), you need to perform a series of steps:
1. First, you need a signed certificate, a private key, and a certificate chain that you want to import.
2. You then need to use the `aws.acmpca.CertificateAuthorityCertificate` resource from the Pulumi AWS library to import this certificate into the ACM PCA.

### Prerequisites:
- You should have the signed certificate, its corresponding private key, and the certificate chain ready to use.
- You should also have a certificate authority (CA) created in ACM PCA to which the certificate will be associated.
- Your AWS credentials should be configured for Pulumi, typically by setting the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables or using an AWS profile.

Below is a TypeScript program that demonstrates how to import a certificate into ACM PCA using Pulumi. Remember to replace placeholders for `certificate`, `privateKey`, `certificateChain`, and `certificateAuthorityArn` with your actual values.

```typescript
import * as aws from "@pulumi/aws";

// Replace the placeholders with actual values of the signed certificate, private key, and certificate chain.
const certificateBody = `-----BEGIN CERTIFICATE-----
MIIDQTCCAimgAwIB...
-----END CERTIFICATE-----`;

const privateKey = `-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCA...
-----END RSA PRIVATE KEY-----`;

const certificateChain = `-----BEGIN CERTIFICATE-----
MIIEpAIBAAKCA...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEpAIBAAKCA...
-----END CERTIFICATE-----`;

// The ARN of the certificate authority in ACM PCA to which you want to associate this certificate.
// You would typically obtain this from the AWS console or from previous Pulumi stack outputs.
const certificateAuthorityArn = "arn:aws:acmpca:region:account:certificate-authority/uuid";

// Import the certificate into ACM PCA
const certImport = new aws.acmpca.CertificateAuthorityCertificate("certImport", {
    certificate: certificateBody,
    privateKey: privateKey,
    certificateChain: certificateChain,
    certificateAuthorityArn: certificateAuthorityArn,
});

// To retrieve the imported certificate details, you can export the ARN like this:
export const certificateArn = certImport.arn;
```

Here's what's happening in the program:
- We import the AWS Pulumi package which allows us to interact with AWS services.
- We specify the raw contents of the signed certificate, private key, and certificate chain as strings.
- We create an instance of the `CertificateAuthorityCertificate` resource, which represents the certificate import action in ACM PCA. We supply it with the certificate details and the ARN of the CA.
- Finally, we export the ARN of the imported certificate for later reference.

### Important Notes:
- The certificate data should be kept secure, and it's typically not recommended to hard-code them directly into the program. You might want to use Pulumi's `Config` to secure sensitive data or read from an external source.
- Ensure that your certificate and key are properly formatted (in PEM format) and match each other; otherwise, the import will fail.
- Don't forget to specify your AWS region, either in the configuration settings or within your resource options, if it differs from your default region.

Run your Pulumi program using the Pulumi CLI with the `pulumi up` command, which will perform the deployment as per the defined resources in the code.