AWS IAM Server Certificate
This page shows how to write Terraform and CloudFormation for IAM Server Certificate and write them securely.
aws_iam_server_certificate (Terraform)
The Server Certificate in IAM can be configured in Terraform with the resource name aws_iam_server_certificate. The following sections describe 1 example of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_iam_server_certificate" "east_cert" {
name = "east_internal_api_cert"
certificate_body = var.internal_certificate
private_key = var.private_key
}
Parameters
-
arnoptional computed - string -
certificate_bodyrequired - string -
certificate_chainoptional - string -
expirationoptional computed - string -
idoptional computed - string -
nameoptional computed - string -
name_prefixoptional - string -
pathoptional - string -
private_keyrequired - string -
tagsoptional - map from string to string -
upload_dateoptional computed - string
Explanation in Terraform Registry
Provides an IAM Server Certificate resource to upload Server Certificates. Certs uploaded to IAM can easily work with other AWS services such as:
- AWS Elastic Beanstalk
- Elastic Load Balancing
- CloudFront
- AWS OpsWorks For information about server certificates in IAM, see [Managing Server Certificates][2] in AWS Documentation.
Note: All arguments including the private key will be stored in the raw state as plain-text. Read more about sensitive data in state.
Tips: Best Practices for The Other AWS IAM Resources
In addition to the aws_iam_account_password_policy, AWS IAM has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_iam_account_password_policy
Ensure AWS IAM account password policies requires long passwords
It's better to enforce the use of long and complex passwords to reduce the risk of bruteforce attacks.
AWS::IAM::ServerCertificate (CloudFormation)
The ServerCertificate in IAM can be configured in CloudFormation with the resource name AWS::IAM::ServerCertificate. The following sections describe 4 examples of how to use the resource and its parameters.
Example Usage from GitHub
Type: AWS::IAM::ServerCertificate
# -- Load balancing -----------------------------------------------------------
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html
Type: AWS::IAM::ServerCertificate
# -- Load balancing -----------------------------------------------------------
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html
Type: AWS::IAM::ServerCertificate
# -- LambdaFunction -----------------------------------------------------------
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html
# AWS Console: https://console.aws.amazon.com/lambda/home?#/functions > Search for {stack}
"AWS::IAM::ServerCertificate": {
"Type": "AWS::IAM::ServerCertificate",
"Properties": {}
},
"AWS::ElastiCache::CacheCluster": {
"Type": "AWS::ElastiCache::CacheCluster",
Parameters
-
CertificateBodyoptional - String -
CertificateChainoptional - String -
ServerCertificateNameoptional - String -
Pathoptional - String -
PrivateKeyoptional - String -
Tagsoptional - List of Tag
Explanation in CloudFormation Registry
Uploads a server certificate entity for the AWS account. The server certificate entity includes a public key certificate, a private key, and an optional certificate chain, which should all be PEM-encoded.
We recommend that you use AWS Certificate Manager to provision, manage, and deploy your server certificates. With ACM you can request a certificate, deploy it to AWS resources, and let ACM handle certificate renewals for you. Certificates provided by ACM are free. For more information about using ACM, see the AWS Certificate Manager User Guide.
For more information about working with server certificates, see Working with server certificates in the IAM User Guide. This topic includes a list of AWS services that can use the server certificates that you manage with IAM.
For information about the number of server certificates you can upload, see IAM and AWS STS quotas in the IAM User Guide.
Note Because the body of the public key certificate, private key, and the certificate chain can be large, you should use POST rather than GET when calling
UploadServerCertificate. For information about setting up signatures and authorization through the API, see Signing AWS API requests in the AWS General Reference. For general information about using the Query API with IAM, see Calling the API by making HTTP query requests in the IAM User Guide.
Frequently asked questions
What is AWS IAM Server Certificate?
AWS IAM Server Certificate is a resource for IAM of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS IAM Server Certificate?
For Terraform, the WilsonSo/terraform-cloud-tier3 source code example is useful. See the Terraform Example section for further details.
For CloudFormation, the Senzing/aws-cloudformation-ecs, Senzing/aws-cloudformation-ecs and Senzing/aws-marketplace-evaluation source code examples are useful. See the CloudFormation Example section for further details.
