feat(certificatemanager): key algorithm support for PrivateCertificate and Certificate

packages/aws-cdk-lib/aws-certificatemanager/README.md

@@ -142,6 +142,7 @@ new acm.PrivateCertificate(this, 'PrivateCertificate', {
  subjectAlternativeNames: ['cool.example.com', 'test.example.net'], // optional
  certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(this, 'CA',
  'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+ keyAlgorithm: acm.KeyAlgorithm.RSA_2048 // optional, default algorithm is RSA_2048
 });
 ```
 

packages/aws-cdk-lib/aws-certificatemanager/lib/certificate.ts

@@ -103,6 +103,36 @@ export interface CertificateProps {
  readonly certificateName?: string
 }
 
+/**
+ * Certificate Manager key algorithm
+ *
+ * If you need to use an algorithm that doesn't exist as a static member, you
+ * can instantiate a `KeyAlgorithm` object, e.g: `new KeyAlgorithm('RSA_2048')`.
+ */
+export class KeyAlgorithm {
+ /**
+ * RSA_2048 algorithm
+ */
+ public static readonly RSA_2048 = new KeyAlgorithm("RSA_2048");
+
+ /**
+ * EC_prime256v1 algorithm
+ */
+ public static readonly EC_PRIME256V1 = new KeyAlgorithm("EC_prime256v1");
+
+ /**
+ * EC_secp384r1 algorithm
+ */
+ public static readonly EC_SECP384R1 = new KeyAlgorithm("EC_secp384r1");
+
+ constructor(
+ /**
+ * The name of the algorithm
+ */
+ public readonly name: string
+ ) { };
+}
+
 /**
  * Properties for certificate validation
  */

packages/aws-cdk-lib/aws-certificatemanager/lib/private-certificate.ts

@@ -1,5 +1,5 @@
 import { Construct } from 'constructs';
-import { ICertificate } from './certificate';
+import { ICertificate, KeyAlgorithm } from './certificate';
 import { CertificateBase } from './certificate-base';
 import { CfnCertificate } from './certificatemanager.generated';
 import * as acmpca from '../../aws-acmpca';
@@ -28,6 +28,13 @@ export interface PrivateCertificateProps {
  * Private certificate authority (CA) that will be used to issue the certificate.
  */
  readonly certificateAuthority: acmpca.ICertificateAuthority;
+
+ /**
+ * Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
+ *
+ * @default KeyAlgorithm.RSA_2048
+ */
+ readonly keyAlgorithm?: KeyAlgorithm;
 }
 
 /**
@@ -59,6 +66,7 @@ export class PrivateCertificate extends CertificateBase implements ICertificate
  domainName: props.domainName,
  subjectAlternativeNames: props.subjectAlternativeNames,
  certificateAuthorityArn: props.certificateAuthority.certificateAuthorityArn,
+ keyAlgorithm: props.keyAlgorithm?.name,
  });
 
  this.certificateArn = cert.ref;

packages/aws-cdk-lib/aws-certificatemanager/test/private-certificate.test.ts

@@ -1,7 +1,7 @@
-import { Template } from '../../assertions';
+import { Match, Template } from '../../assertions';
 import * as acmpca from '../../aws-acmpca';
 import { Duration, Lazy, Stack } from '../../core';
-import { PrivateCertificate } from '../lib';
+import { KeyAlgorithm, PrivateCertificate } from '../lib';
 
 test('private certificate authority', () => {
  const stack = new Stack();
@@ -100,3 +100,49 @@ test('metricDaysToExpiry', () => {
  renderingProperties: expect.anything(),
  });
 });
+
+describe('Key Algorithm', () => {
+ test('key algorithm is undefined if not provided', () => {
+ const stack = new Stack();
+
+ new PrivateCertificate(stack, 'Certificate', {
+ domainName: 'test.example.com',
+ certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+ 'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+ });
+
+ Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+ KeyAlgorithm: Match.absent(),
+ });
+ });
+
+ test('Can specify algorithm', () => {
+ const stack = new Stack();
+
+ new PrivateCertificate(stack, 'Certificate', {
+ domainName: 'test.example.com',
+ certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+ 'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+ keyAlgorithm: KeyAlgorithm.EC_SECP384R1
+ });
+
+ Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+ KeyAlgorithm: 'EC_secp384r1',
+ });
+ });
+
+ test('Can specify any arbitrary algorithm', () => {
+ const stack = new Stack();
+
+ new PrivateCertificate(stack, 'Certificate', {
+ domainName: 'test.example.com',
+ certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+ 'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+ keyAlgorithm: new KeyAlgorithm("any value"),
+ });
+
+ Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+ KeyAlgorithm: 'any value',
+ });
+ });
+});