How do I share the private CA that I created in AWS Private CA with another account?

Short description

To share a private CA with another account, use AWS Resource Access Manager (AWS RAM) to create a resource share.

You can also share a private CA with the following entities:

• Other principals, such as AWS Identity and Access Management (IAM) users and roles
• Organizational units (OUs)
• Your entire AWS Organizations organization

When you share your private CA, users and roles in other accounts can issue private x509 certificates that the shared private CA signs.

Resolution

Create an AWS RAM resource share in the account where your private CA is located.

Note: AWS RAM is an AWS Regional service, and a resource share is Regional. You must access the private CA resource share from the same Region where you created it.

To share a private CA with another account, complete the following steps:

1. In the account that has the private CA, create a resource share in AWS RAM.
   Note: When you create the resource share, choose the correct permission for the certificate type that you want to issue. For example, to issue end-entity certificates with the default certificate template arn:aws:acm-pca:::template/EndEntityCertificate/V1, choose the default permission AWSRAMDefaultPermissionCertificateAuthority. To issue a subordinate certificate (PathLen0) with the certificate template arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1, choose AWSRAMSubordinateCACertificatePathLen0IssuanceCertificateAuthority.
2. Accept the shared resource in the other account. If you use Organizations to share and turned on resource sharing within Organizations, then skip to step 6.
3. In the other account, open the AWS RAM console in the same Region where the private CA is located.
4. Under Shared with me, choose Resource shares to view the invitation.
5. Select the name of the shared resource, and then choose Accept resource share.
   Note: After you accept the share, the status becomes Active.
6. In the other account, open the AWS Private CA console in the Region where the private CA is located to view the shared private CA in your account.

Related information

How to use AWS RAM to share your AWS Certificate Manager (ACM) AWS Private CA cross-account