Private Certificate Authority (PCA)

The Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN for the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined by the PCA, see Table 3.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by PCA, see Conditions.

The following table lists the actions that you can define in SCP statements for PCA.

**Table 1** Actions supported by PCA
Action	Description	Access Level	Resource Type (*: Required)	Condition Key
pca:ca:create	Grants the permission to create a private CA.	write	ca *	-
pca:ca:create	Grants the permission to create a private CA.	write	-	g:EnterpriseProjectId
pca:ca:delete	Grants the permission to delete a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:delete	Grants the permission to delete a private CA.	write	-	g:EnterpriseProjectId
pca:ca:disable	Grants the permission to disable a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:disable	Grants the permission to disable a private CA.	write	-	g:EnterpriseProjectId
pca:ca:enable	Grants the permission to enable a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:enable	Grants the permission to enable a private CA.	write	-	g:EnterpriseProjectId
pca:ca:export	Grants the permission to export a private CA certificate.	read	ca *	g:ResourceTag/<tag-key>
pca:ca:export	Grants the permission to export a private CA certificate.	read	-	g:EnterpriseProjectId
pca:ca:getCsr	Grants the permission to export the certificate signing request (CSR) of a private CA.	read	ca *	g:ResourceTag/<tag-key>
pca:ca:getCsr		read	-	g:EnterpriseProjectId
pca:ca:import	Grants the permission to import a certificate as a private CA certificate.	write	ca *	-
pca:ca:import		write	-	g:EnterpriseProjectId
pca:ca:activate	Grants the permission to activate a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:activate	Grants the permission to activate a private CA.	write	-	g:EnterpriseProjectId
pca:ca:list	Grants the permission to query the private CA list.	list	ca *	-
pca:ca:list	Grants the permission to query the private CA list.	list	-	g:EnterpriseProjectId
pca:ca:restore	Grants the permission to restore a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:restore	Grants the permission to restore a private CA.	write	-	g:EnterpriseProjectId
pca:ca:revoke	Grants the permission to revoke a private CA.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:revoke	Grants the permission to revoke a private CA.	write	-	g:EnterpriseProjectId
pca:ca:get	Grants the permission to query private CA details.	read	ca *	g:ResourceTag/<tag-key>
pca:ca:get	Grants the permission to query private CA details.	read	-	g:EnterpriseProjectId
pca:ca:quota	Grants the permission to query the private CA quota.	read	-	-
pca:ca:createTag	Grants the permission to create or update tags for a private CA.	tagging	ca *	g:ResourceTag/<tag-key>
pca:ca:createTag		tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
pca:ca:deleteTag	Grants the permission to delete a private CA tag.	tagging	ca *	g:ResourceTag/<tag-key>
pca:ca:deleteTag	Grants the permission to delete a private CA tag.	tagging	-	g:EnterpriseProjectId g:TagKeys
pca:ca:listTags	Grants the permission to query the tag list of a private CA.	list	ca *	g:ResourceTag/<tag-key>
pca:ca:listTags		list	-	g:EnterpriseProjectId
pca:ca:listAllTags	Grants the permission to query the private CA tag list.	list	ca *	-
pca:ca:listByTag	Grants the permission to query the private CA list by tag.	list	ca *	-
pca:ca:listByTag	Grants the permission to query the private CA list by tag.	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
pca:ca:issueCert	Grants the permission to issue a private certificate.	write	ca *	-
pca:ca:issueCert	Grants the permission to issue a private certificate.	write	-	g:EnterpriseProjectId pca:CommonName
pca:ca:issueCertByCsr	Grants the permission to issue private certificates based on CSRs.	write	ca *	-
pca:ca:issueCertByCsr		write	-	g:EnterpriseProjectId pca:CommonName
pca:cert:delete	Grants the permission to delete a private certificate.	write	-	g:EnterpriseProjectId
pca:cert:export	Grants the permission to export a private certificate.	read	-	g:EnterpriseProjectId
pca:cert:list	Grants the permission to query the private certificate list.	list	-	g:EnterpriseProjectId
pca:ca:revokeCert	Grants the permission to revoke a private certificate.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:revokeCert	Grants the permission to revoke a private certificate.	write	-	g:EnterpriseProjectId
pca:cert:get	Grants the permission to query private certificate details.	read	-	g:EnterpriseProjectId
pca:cert:quota	Grants the permission to query the private certificate quota.	read	-	-
pca:cert:createTag	Grants the permission to create or update private certificate tags.	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
pca:cert:deleteTag	Grants the permission to delete a private certificate tag.	tagging	-	g:EnterpriseProjectId g:TagKeys
pca:cert:listTags	Grants the permission to query the tag list of a private certificate.	list	-	g:EnterpriseProjectId
pca:cert:listAllTags	Grants the permission to query the private certificate tag list.	list	-	-
pca:cert:listByTag	Grants the permission to query the private certificate list by tag.	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
pca:ca:disableCrl	Grants the permission to disable CRLs.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:disableCrl	Grants the permission to disable CRLs.	write	-	g:EnterpriseProjectId
pca:ca:enableCrl	Grants the permission to enable CRLs.	write	ca *	g:ResourceTag/<tag-key>
pca:ca:enableCrl	Grants the permission to enable CRLs.	write	-	g:EnterpriseProjectId

Each API of PCA usually supports one or more actions. Table 2 lists the actions and dependencies supported by PCA APIs.

**Table 2** Actions and dependencies supported by PCA APIs
API	Action	Dependencies
POST /v1/private-certificate-authorities	pca:ca:create	-
POST /v1/private-certificate-authorities/order	pca:ca:create	-
DELETE /v1/private-certificate-authorities/{ca_id}	pca:ca:delete	-
POST /v1/private-certificate-authorities/{ca_id}/disable	pca:ca:disable	-
POST /v1/private-certificate-authorities/{ca_id}/enable	pca:ca:enable	-
POST /v1/private-certificate-authorities/{ca_id}/export	pca:ca:export	-
GET /v1/private-certificate-authorities/{ca_id}/csr	pca:ca:getCsr	-
POST /v1/private-certificate-authorities/{ca_id}/import	pca:ca:import	-
POST /v1/private-certificate-authorities/{ca_id}/activate	pca:ca:activate	-
GET /v1/private-certificate-authorities	pca:ca:list	-
POST /v1/private-certificate-authorities/{ca_id}/restore	pca:ca:restore	-
POST /v1/private-certificate-authorities/{ca_id}/revoke	pca:ca:revoke	-
GET /v1/private-certificate-authorities/{ca_id}	pca:ca:get	-
GET /v1/private-certificate-authorities/quotas	pca:ca:quota	-
POST /v1/private-certificate-authorities/{ca_id}/tags/create	pca:ca:createTag	-
DELETE /v1/private-certificate-authorities/{ca_id}/tags/delete	pca:ca:deleteTag	-
POST /v1/private-certificate-authorities/{ca_id}/tags	pca:ca:createTag	-
GET /v1/private-certificate-authorities/{ca_id}/tags	pca:ca:listTags	-
GET /v1/private-certificate-authorities/tags	pca:ca:listAllTags	-
POST /v1/private-certificate-authorities/resource-instances/filter	pca:ca:listByTag	-
POST /v1/private-certificates	pca:ca:issueCert	-
POST /v1/private-certificates/csr	pca:ca:issueCertByCsr	-
DELETE /v1/private-certificates/{certificate_id}	pca:cert:delete	-
POST /v1/private-certificates/{certificate_id}/export	pca:cert:export	-
GET /v1/private-certificates	pca:cert:list	-
POST /v1/private-certificates/{certificate_id}/revoke	pca:ca:revokeCert	-
GET /v1/private-certificates/{certificate_id}	pca:cert:get	-
GET /v1/private-certificates/quotas	pca:cert:quota	-
POST /v1/private-certificates/{certificate_id}/tags/create	pca:cert:createTag	-
DELETE /v1/private-certificates/{certificate_id}/tags/delete	pca:cert:deleteTag	-
POST /v1/private-certificates/{certificate_id}/tags	pca:cert:createTag	-
GET /v1/private-certificates/{certificate_id}/tags	pca:cert:listTags	-
GET /v1/private-certificates/tags	pca:cert:listAllTags	-
POST /v1/private-certificates/resource-instances/filter	pca:cert:listByTag	-
POST /v1/private-certificate-authorities/{ca_id}/crl/disable	pca:ca:disableCrl	-
POST /v1/private-certificate-authorities/{ca_id}/crl/enable	pca:ca:enableCrl	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can define in SCP statements for PCA.

**Table 3** Resource types supported by PCA
Resource Type	URN
ca	pca:<region>:<account-id>:ca:<ca-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, IAM automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, pca:) apply only to operations of the corresponding service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported operators, see Condition operators.

The following table lists the condition keys that you can define in SCPs for PCA. You can include these condition keys to specify conditions for when your SCP is in effect.