You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ After initial authentication, temporary credentials are used by using the Assume
41
41
42
42
This integration also supports the reading of existing certificate ACM key/value pair tags during inventory and adding these tags when adding new certificates.
43
43
Modifying and adding ACM tags during certificate renewal, however, is NOT supported.
44
-
This is due to the fact that the AWS API does not allow for ACM tag modification when updating a certificate in one step.
44
+
This is because the AWS API does not allow for ACM tag modification when updating a certificate in one step.
45
45
This would need to be done in multiple steps, leading to the possibility of the certificate being left in an error state if any intermediate step were to fail.
46
46
However, while the modification/addition of ACM tags is not supported, all existing ACM tags WILL remain in place during renewal.
47
47
@@ -70,16 +70,16 @@ Before installing the AWS Certificate Manager (ACM) Universal Orchestrator exten
70
70
71
71
Field usage has changed in v3, notably:
72
72
*`ServerUsername` and `ServerPassword` are no longer used
73
-
* Specific fields for IAM and OAuth are defined for credentials of those type
73
+
* Specific fields for IAM and OAuth are defined for credentials of those types
74
74
*`Store Path` only allows a __single__ AWS Region to be defined
75
75
* The Entry Parameter for AWS Region is no longer used
76
76
*`Client Machine` requires the _full_ Role ARN to be used for Assume Role calls
77
77
78
78
As a result, previous Store Types are no longer supported, and Certificate Stores of those types need to be migrated to the v3 type.
79
-
Inventory jobs will need be to run after creating the new Certificate Stores to begin tracking those certificates again.
79
+
Inventory jobs will need to be to run after creating the new Certificate Stores to begin tracking those certificates again.
80
80
The deprecated Stores and Store Types can be deleted after they are no longer needed.
81
81
82
-
_Currently there is no provided migration utility to perform this programatically._
82
+
_Currently, there is no provided migration utility to perform this programmatically._
83
83
84
84
### Setting up AWS Authentication (Examples)
85
85
@@ -100,9 +100,9 @@ If the EC2 Role assigned to the instance is only to be used initially, and a new
100
100
then the `Assume new Role using Default SDK Auth` should also be selected.
101
101
102
102
### AWS Setup
103
-
_Note: In this scenario the AWS-ACM-v3 extension needs to be running inside of an EC2 instance._
103
+
_Note: In this scenario, the AWS-ACM-v3 extension needs to be running inside an EC2 instance._
104
104
1. Assign or note the existing IAM Role assigned to the EC2 instance running. [Found in EC2 here](docsource/images/ec2-instance-iam-role.gif).
105
-
2. Ensure a [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is setup for that role. [Example](docsource/images/ec2-role-arn-trust-relationship.gif).
105
+
2. Ensure a [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is set up for that role. [Example](docsource/images/ec2-role-arn-trust-relationship.gif).
106
106
3. Verify the permissions match the requirements for accessing ACM.
107
107
108
108
</details>
@@ -114,15 +114,15 @@ _Note: In this scenario the AWS-ACM-v3 extension needs to be running inside of a
114
114
Select the `Use OAuth` option for a certificate store to use an OAuth Identity Provider.
115
115
116
116
### AWS Setup
117
-
1. A 3rd party [Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) similar to [this](docsource/images/AWSIdentityProvider.gif) needs to be setup in AWS.
117
+
1. A 3rd party [Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) similar to [this](docsource/images/AWSIdentityProvider.gif) needs to be set up in AWS.
118
118
2. An [AWS Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) needs to be created to be used with your Identity Provider.
119
-
3. Ensure the [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is setup for that role with the Identity Provider. [Example](docsource/images/AWSRole2.gif).
119
+
3. Ensure the [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is set up for that role with the Identity Provider. [Example](docsource/images/AWSRole2.gif).
120
120
4. Verify the permissions match the requirements for accessing ACM.
121
121
122
122
### OKTA Setup
123
-
1. Ensure your Authorization Server Is Setup in OKTA. Here is a [sample](docsource/images/OktaSampleAuthorizationServer.gif).
124
-
2. Ensure the appropriate scopes are setup in Okta. Here is a [sample](docsource/images/OktaSampleAuthorizationServer-scopes.gif).
125
-
3.Setup an Okta App with similar settings to [this](docsource/images/OktaApp1.gif) and [this](docsource/images/OktaApp2.gif).
123
+
1. Ensure your Authorization Server Is Set up in OKTA. Here is a [sample](docsource/images/OktaSampleAuthorizationServer.gif).
124
+
2. Ensure the appropriate scopes are set up in Okta. Here is a [sample](docsource/images/OktaSampleAuthorizationServer-scopes.gif).
125
+
3.Set up an Okta App with similar settings to [this](docsource/images/OktaApp1.gif) and [this](docsource/images/OktaApp2.gif).
126
126
127
127
</details>
128
128
@@ -134,7 +134,7 @@ Select the `Use IAM` option for a certificate store to use an IAM User credentia
134
134
135
135
### AWS Setup
136
136
1. An [AWS Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) to Assume with your IAM User needs to be created.
137
-
2. Ensure a [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is setup for that role. [Example](docsource/images/AssumeRoleTrust.gif).
137
+
2. Ensure a [Trust Relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) is set up for that role. [Example](docsource/images/AssumeRoleTrust.gif).
138
138
3. AWS does not support programmatic access for AWS SSO accounts. The account used here must be a [standard AWS IAM User](docsource/images/UserAccount.gif) with an Access Key credential type.
139
139
4. Verify the permissions match the requirements for accessing ACM.
140
140
@@ -148,8 +148,8 @@ To use the AWS Certificate Manager (ACM) Universal Orchestrator extension, you *
148
148
149
149
150
150
The AWS Certificate Manager v3 Store Type provides enhanced authentication options for managing certificates in ACM.
151
-
Each defined Certificate Store of this type targes a specific AWS Region with a specific Destination account in mind.
152
-
Therefore each Certificate Store instance is intended to represent a single Role's certificates in a single AWS Region.
151
+
Each defined Certificate Store of this type targets a specific AWS Region with a specific Destination account in mind.
152
+
Therefore, each Certificate Store instance is intended to represent a single Role's certificates in a single AWS Region.
153
153
154
154
Some authentication configurations do not adhere strictly to this, so when using the various methods offered in the Default SDK auth option,
155
155
a full understanding of how permissions work in AWS is recommended.
0 commit comments