acm

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 32 Imported by: 0

README

ACM

Parity grade: A · SDK aws-sdk-go-v2/service/acm@v1.37.21 · last audited 2026-07-13 (024e43bf)

Coverage

Metric Value
Operations audited 16 (16 ok)
Known gaps 3
Deferred items 2
Resource leaks clean
Known gaps
  • CertificateSummary (ListCertificates) omits optional AWS fields Exported/ExportOption/InUse/ManagedBy/KeyUsages/ExtendedKeyUsages/HasAdditionalSubjectAlternativeNames entirely; not wired to any backend tracking. Deferred as a feature gap, not a wire bug (fields are optional on the real wire too).
  • CertificateDetail omits ManagedBy (AWS: which service, e.g. CLOUDFRONT, manages the cert) — no backend concept of managed-by exists. Feature gap, not audited further this pass.
  • Malformed/garbage ARNs on read ops (Describe/Get/Export/Renew/etc.) return ResourceNotFoundException; real AWS returns InvalidArnException for arns that fail ARN-shape validation before the not-found check. Not fixed this pass (low traffic path, needs ARN-shape validator).
Deferred
  • CertificateSummary optional-field parity (Exported/ManagedBy/etc., see gaps)
  • InvalidArnException vs ResourceNotFoundException distinction on malformed ARNs

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrCertNotFound      = errors.New("ResourceNotFoundException")
	ErrInvalidParameter  = errors.New("ValidationException")
	ErrNotEligible       = errors.New("RequestInProgressException")
	ErrRequestInProgress = errors.New("RequestInProgressException")
	ErrAlreadyRevoked    = errors.New("InvalidStateException")
	ErrInvalidState      = errors.New("InvalidStateException")
	ErrResourceInUse     = errors.New("ResourceInUseException")
	ErrConflict          = errors.New("ConflictException")
)

Functions

This section is empty.

Types

type AccountConfig 

type AccountConfig struct {
	DaysBeforeExpiry int32 `json:"daysBeforeExpiry"`
}

AccountConfig holds account-level ACM configuration.

type Certificate 

type Certificate struct {
	CreatedAt  time.Time  `json:"createdAt"`
	NotBefore  time.Time  `json:"notBefore"`
	NotAfter   time.Time  `json:"notAfter"`
	RevokedAt  *time.Time `json:"revokedAt,omitempty"`
	IssuedAt   *time.Time `json:"issuedAt,omitempty"`
	ImportedAt *time.Time `json:"importedAt,omitempty"`
	// RenewalSummary describes the state of the most recent managed renewal attempt.
	// It is set when RenewCertificate is called on an AMAZON_ISSUED certificate.
	RenewalSummary                     *RenewalSummary `json:"renewalSummary,omitempty"`
	RenewalEligibility                 string          `json:"renewalEligibility,omitempty"`
	PrivateKey                         string          `json:"privateKey,omitempty"`
	Subject                            string          `json:"subject,omitempty"`
	Issuer                             string          `json:"issuer,omitempty"`
	KeyAlgorithm                       string          `json:"keyAlgorithm,omitempty"`
	SignatureAlgorithm                 string          `json:"signatureAlgorithm,omitempty"`
	Status                             string          `json:"status"`
	Type                               string          `json:"type"`
	RevocationReason                   string          `json:"revocationReason,omitempty"`
	DomainName                         string          `json:"domainName"`
	ValidationMethod                   string          `json:"validationMethod,omitempty"`
	CertificateBody                    string          `json:"certificateBody,omitempty"`
	CertificateChain                   string          `json:"certificateChain,omitempty"`
	Serial                             string          `json:"serial,omitempty"`
	CertificateTransparencyLoggingPref string          `json:"certTransparencyLoggingPref,omitempty"`
	IdempotencyToken                   string          `json:"idempotencyToken,omitempty"`
	CertificateAuthorityArn            string          `json:"certificateAuthorityArn,omitempty"`
	KeyID                              string          `json:"keyId,omitempty"`
	// FailureReason is set when the certificate enters FAILED status.
	FailureReason string `json:"failureReason,omitempty"`

	ARN                     string                   `json:"arn"`
	DomainValidationOptions []DomainValidationOption `json:"domainValidationOptions,omitempty"`
	// InUseBy holds the ARNs of AWS resources that use this certificate.
	InUseBy []string `json:"inUseBy,omitempty"`
	// KeyUsage lists the allowed key usages parsed from the X.509 certificate.
	KeyUsage []string `json:"keyUsage,omitempty"`
	// ExtendedKeyUsage lists the extended key usages parsed from the X.509 certificate.
	ExtendedKeyUsage        []string `json:"extendedKeyUsage,omitempty"`
	SubjectAlternativeNames []string `json:"subjectAlternativeNames,omitempty"`
	// contains filtered or unexported fields
}

Certificate represents an ACM certificate.

type DomainValidationOption 

type DomainValidationOption struct {
	ResourceRecord   *ResourceRecord `json:"resourceRecord,omitempty"`
	DomainName       string          `json:"domainName"`
	ValidationDomain string          `json:"validationDomain"`
	ValidationStatus string          `json:"validationStatus"`
	ValidationMethod string          `json:"validationMethod"`
	// ValidationEmails is populated when ValidationMethod is EMAIL.
	ValidationEmails []string `json:"validationEmails,omitempty"`
}

DomainValidationOption holds the validation details for a single domain.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ACM operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new ACM handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ACM instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ACM action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the certificate ARN from the JSON body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns supported ACM operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all handler tag state and delegates to the backend Reset.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend and restoring the handler's tag state.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ACM JSON-protocol requests.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the background janitor and all in-flight certificate auto-validation timers so no goroutine outlives the service.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend and also capturing the handler's tag state.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor for idempotency tokens.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for ACM certificates. InMemoryBackend stores ACM state. certs is a single flat store.Table keyed by the composite "region|arn" string (see regionKey) with a companion byRegion Index, replacing the previous map[region]map[arn]*Certificate nesting -- see store_setup.go. The remaining maps are non-*T value maps (their values are plain structs, not pointers) and stay nested by region as plain maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AddInUseBy 

func (b *InMemoryBackend) AddInUseBy(ctx context.Context, certARN, resourceARN string)

AddInUseBy records that a resource ARN is using the certificate. It is a no-op if the certificate does not exist or the ARN is already present.

func (*InMemoryBackend) CertExists 

func (b *InMemoryBackend) CertExists(ctx context.Context, certARN string) bool

CertExists reports whether a certificate with the given ARN exists in the backend. This is used by the handler to validate tag operations.

func (*InMemoryBackend) Close 

func (b *InMemoryBackend) Close()

Close stops all in-flight certificate auto-validation timers so their goroutines do not outlive the backend, without otherwise clearing state. It is safe to call multiple times.

func (*InMemoryBackend) DeleteCertificate 

func (b *InMemoryBackend) DeleteCertificate(ctx context.Context, certARN string) error

DeleteCertificate removes the certificate with the given ARN.

func (*InMemoryBackend) DescribeCertificate 

func (b *InMemoryBackend) DescribeCertificate(ctx context.Context, arn string) (*Certificate, error)

DescribeCertificate returns the certificate with the given ARN.

func (*InMemoryBackend) ExpireCertificate 

func (b *InMemoryBackend) ExpireCertificate(ctx context.Context, certARN string) error

ExpireCertificate transitions an ISSUED certificate to EXPIRED status. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in ISSUED status.

func (*InMemoryBackend) ExportCertificate 

func (b *InMemoryBackend) ExportCertificate(
	ctx context.Context, certARN string, passphrase []byte,
) (*Certificate, error)

ExportCertificate returns the PEM certificate body, chain, and private key for an IMPORTED or PRIVATE certificate. Returns ErrNotEligible for AMAZON_ISSUED certificates. When the stored certificate has no associated chain, a fake chain (intermediate + root) is returned in PEM format to simulate AWS ACM behaviour. If passphrase is non-nil and non-empty, the private key is returned encrypted using AES-256.

func (*InMemoryBackend) FailCertificate 

func (b *InMemoryBackend) FailCertificate(ctx context.Context, certARN, reason string) error

FailCertificate transitions a PENDING_VALIDATION certificate to FAILED status with the given failure reason. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in PENDING_VALIDATION status.

func (*InMemoryBackend) GetAccountConfiguration 

func (b *InMemoryBackend) GetAccountConfiguration(ctx context.Context) AccountConfig

GetAccountConfiguration returns the account-level ACM configuration for the request region.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(ctx context.Context, certARN string) (string, string, error)

GetCertificate returns the PEM certificate body and chain for any certificate.

func (*InMemoryBackend) ImportCertificate 

func (b *InMemoryBackend) ImportCertificate(
	ctx context.Context,
	certBody, privateKey, certChain, certARNToUpdate string,
) (*Certificate, error)

ImportCertificate stores a PEM-encoded certificate, private key, and optional certificate chain, returning the ARN of the newly created or updated entry. When certARNToUpdate is non-empty, the existing certificate is updated in-place (re-import), matching AWS behavior where CertificateArn may be passed to replace an existing imported certificate.

func (*InMemoryBackend) InactivateCertificate 

func (b *InMemoryBackend) InactivateCertificate(ctx context.Context, certARN string) error

InactivateCertificate transitions an ISSUED certificate to INACTIVE status. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in ISSUED status.

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(
	ctx context.Context, p ListCertificatesParams,
) (page.Page[Certificate], error)

ListCertificates returns a paginated list of certificates, with optional filtering and sorting.

func (*InMemoryBackend) PutAccountConfiguration 

func (b *InMemoryBackend) PutAccountConfiguration(
	ctx context.Context, idempotencyToken string, daysBeforeExpiry *int32,
) error

PutAccountConfiguration stores the account-level ACM configuration. idempotencyToken must be non-empty; repeated calls with the same token are silently accepted only when the configuration is identical (AWS behavior). A conflicting call with the same token but different settings returns ErrConflict.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RemoveInUseBy 

func (b *InMemoryBackend) RemoveInUseBy(ctx context.Context, certARN, resourceARN string)

RemoveInUseBy removes a resource ARN from the certificate's InUseBy list. It is a no-op if the certificate does not exist or the ARN is not present.

func (*InMemoryBackend) RenewCertificate 

func (b *InMemoryBackend) RenewCertificate(ctx context.Context, certARN string) error

RenewCertificate regenerates the certificate material for an AMAZON_ISSUED certificate, extending its validity by one year. Returns ErrNotEligible for IMPORTED certificates, as AWS ACM does not support renewing imported certificates.

func (*InMemoryBackend) RequestCertificate 

func (b *InMemoryBackend) RequestCertificate(
	ctx context.Context,
	domainName, certType, validationMethod, idempotencyToken, keyAlgorithm, caArn, optionsPref string,
	sans []string,
) (*Certificate, error)

RequestCertificate creates a new certificate for the given domain. When validationMethod is "DNS" or "EMAIL" the certificate starts in PENDING_VALIDATION and automatically transitions to ISSUED after a short delay. idempotencyToken, if non-empty, deduplicates the request — repeated calls with the same token return the previously created certificate ARN.

func (*InMemoryBackend) ResendValidationEmail 

func (b *InMemoryBackend) ResendValidationEmail(ctx context.Context, certARN, domain, validationDomain string) error

ResendValidationEmail re-triggers the EMAIL validation flow for a certificate that is still in PENDING_VALIDATION status with EMAIL validation method.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all certificate state and stops any pending auto-validate timers.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RevokeCertificate 

func (b *InMemoryBackend) RevokeCertificate(ctx context.Context, certARN, revocationReason string) error

RevokeCertificate marks the certificate as REVOKED with the given reason. Returns ErrAlreadyRevoked if the certificate is already revoked. Only ISSUED certificates can be revoked; PENDING_VALIDATION certs return ErrInvalidParameter.

func (*InMemoryBackend) RunJanitor 

func (b *InMemoryBackend) RunJanitor(ctx context.Context, interval time.Duration)

RunJanitor periodically cleans up expired idempotency tokens.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TimeoutPendingValidation 

func (b *InMemoryBackend) TimeoutPendingValidation(ctx context.Context, certARN string) error

TimeoutPendingValidation transitions a PENDING_VALIDATION certificate to VALIDATION_TIMED_OUT. Returns ErrCertNotFound if no such certificate exists, ErrInvalidParameter if the certificate is not in PENDING_VALIDATION status.

func (*InMemoryBackend) UpdateCertificateOptions 

func (b *InMemoryBackend) UpdateCertificateOptions(ctx context.Context, certARN, transparencyLoggingPref string) error

UpdateCertificateOptions sets the CertificateTransparencyLoggingPreference for a certificate. Only ISSUED certificates may be updated.

type ListCertificatesParams 

type ListCertificatesParams struct {
	NextToken        string
	SortBy           string
	SortOrder        string
	StatusFilter     []string
	KeyTypes         []string
	KeyUsage         []string
	ExtendedKeyUsage []string
	MaxItems         int
}

ListCertificatesParams holds all filter and sorting options for ListCertificates.

type Provider 

type Provider struct{}

Provider implements service.Provider for ACM.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the ACM service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RenewalSummary 

type RenewalSummary struct {
	// RenewalStatus is the status of the renewal (e.g. PENDING_VALIDATION, SUCCESS).
	RenewalStatus string `json:"RenewalStatus"`
	// DomainValidationOptions contains per-domain validation details for the renewal.
	DomainValidationOptions []DomainValidationOption `json:"DomainValidationOptions,omitempty"`
}

RenewalSummary describes the state of an ACM managed renewal for a certificate.

type ResourceRecord 

type ResourceRecord struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Value string `json:"value"`
}

ResourceRecord holds the CNAME record used for DNS certificate validation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.