@@ -1236,21 +1236,19 @@ defmodule AWS.ACMPCA do
12361236 end
12371237
12381238 @ doc """
1239- Creates an audit report that lists every time that your CA private key is used.
1239+ Creates an audit report that lists every time that your CA private key is used
1240+ to issue a certificate.
12401241
12411242 The
1242- report is saved in the Amazon S3 bucket that you specify on input. The
12431243 [IssueCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html) and
12441244 [RevokeCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html)
12451245 actions use
12461246 the private key.
12471247
1248- Both Amazon Web Services Private CA and the IAM principal must have permission
1249- to write to
1250- the S3 bucket that you specify. If the IAM principal making the call
1251- does not have permission to write to the bucket, then an exception is
1252- thrown. For more information, see [Access policies for CRLs in Amazon
1253- S3](https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#s3-policies).
1248+ To save the audit report to your designated Amazon S3 bucket, you must create a
1249+ bucket policy that grants Amazon Web Services Private CA permission to access
1250+ and write to it. For an example policy, see [Prepare an Amazon S3 bucket for audit
1251+ reports](https://docs.aws.amazon.com/privateca/latest/userguide/PcaAuditReport.html#s3-access).
12541252
12551253 Amazon Web Services Private CA assets that are stored in Amazon S3 can be
12561254 protected with encryption.
@@ -1748,62 +1746,63 @@ defmodule AWS.ACMPCA do
17481746 certificate or chain.
17491747
17501748 *
1751- Basic constraints (*must* be marked critical)
1749+ Authority key identifier
17521750
17531751 *
1754- Subject alternative names
1752+ Basic constraints (*must* be marked critical)
17551753
17561754 *
1757- Key usage
1755+ Certificate policies
17581756
17591757 *
17601758 Extended key usage
17611759
17621760 *
1763- Authority key identifier
1761+ Inhibit anyPolicy
17641762
17651763 *
1766- Subject key identifier
1764+ Issuer alternative name
17671765
17681766 *
1769- Issuer alternative name
1767+ Key usage
17701768
17711769 *
1772- Subject directory attributes
1770+ Name constraints
17731771
17741772 *
1775- Subject information access
1773+ Policy mappings
17761774
17771775 *
1778- Certificate policies
1776+ Subject alternative name
17791777
17801778 *
1781- Policy mappings
1779+ Subject directory attributes
17821780
17831781 *
1784- Inhibit anyPolicy
1782+ Subject key identifier
1783+
1784+ *
1785+ Subject information access
17851786
17861787 Amazon Web Services Private CA rejects the following extensions when they are
17871788 marked critical in an
17881789 imported CA certificate or chain.
17891790
17901791 *
1791- Name constraints
1792-
1793- *
1794- Policy constraints
1792+ Authority information access
17951793
17961794 *
17971795 CRL distribution points
17981796
1799- *
1800- Authority information access
1801-
18021797 *
18031798 Freshest CRL
18041799
18051800 *
1806- Any other extension
1801+ Policy constraints
1802+
1803+ Amazon Web Services Private Certificate Authority will also reject any other
1804+ extension marked as critical not contained on the preceding list of allowed
1805+ extensions.
18071806 """
18081807 @ spec import_certificate_authority_certificate (
18091808 map ( ) ,
0 commit comments