Prerequisites

Standard prerequisites

  • A Linux or Windows (WSL) client machine. The connector officially supports the following versions:

    • CentOS 7, 8, 9

    • RHEL 7, 8, 9

    • Ubuntu 20.04, 22.04

    • Debian 10, 11

    • Windows Subsystem for Linux (WSL)

  • System requirements:

    • (Minimum) A single-core CPU, 1 GB RAM, 100 MB of free space

    • (Recommended) A dual-core CPU, 2 GB RAM, 1 GB of free space

  • An active SCM account

  • An organization created in SCM

  • Domains validated in SCM

  • The ACME service enabled and the ACME server endpoints configured by your Sectigo account manager

  • An ACME account registered for the organization

  • External Account Binding values obtained for the ACME account

    Make a note of ACME URL, Key ID, and HMAC Key ACME account details for client registration.

  • An active AWS account with the required permissions on AWS resources

  • Terraform v1.0.8 or later

  • AWS CLI v1 or AWS CLI v2

    All examples of the Lambda function invocation in this document use the AWS CLI v1. However, you can also invoke the function with AWS CLI v2.

  • AWS programmatic access

Additional prerequisites for private API gateway deployment

If your AWS organization’s SCP forbids public API gateway endpoints, or you want all connector traffic to remain inside your VPC, the following additional prerequisites apply:

  • A VPC with enableDnsSupport and enableDnsHostnames set to true.

  • At least one subnet in the VPC.

  • A security group that allows inbound HTTPS (443) from the resources that will invoke the API.

  • An interface VPC endpoint for the execute-api service must be created before running Terraform. For example:

    aws ec2 create-vpc-endpoint \
  --vpc-id <vpc-id> \
  --service-name com.amazonaws.<region>.execute-api \
  --vpc-endpoint-type Interface \
  --subnet-ids <subnet-id-1> <subnet-id-2> \
  --security-group-ids <sg-id> \
  --private-dns-enabled

    NOTE: The VpcEndpointId (e.g. vpce-xxxxxxxxxxxxxxx) is returned. You need to pass it as the vpc_endpoint_id terraform variable during installation.

Required permissions on AWS resources

The installation script requires the following permissions on AWS resources.

API gateway, DynamoDB, Lambda, S3

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "apigateway:*",
                "lambda:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeContributorInsights",
                "dynamodb:RestoreTableToPointInTime",
                "dynamodb:UpdateGlobalTable",
                "dynamodb:DeleteTable",
                "dynamodb:UpdateTableReplicaAutoScaling",
                "dynamodb:DescribeTable",
                "dynamodb:PartiQLInsert",
                "dynamodb:GetItem",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeExport",
                "dynamodb:EnableKinesisStreamingDestination",
                "dynamodb:BatchGetItem",
                "dynamodb:DisableKinesisStreamingDestination",
                "dynamodb:UpdateTimeToLive",
                "dynamodb:BatchWriteItem",
                "dynamodb:PutItem",
                "dynamodb:PartiQLUpdate",
                "dynamodb:Scan",
                "dynamodb:StartAwsBackupJob",
                "dynamodb:UpdateItem",
                "dynamodb:UpdateGlobalTableSettings",
                "dynamodb:CreateTable",
                "dynamodb:RestoreTableFromAwsBackup",
                "dynamodb:GetShardIterator",
                "dynamodb:ExportTableToPointInTime",
                "dynamodb:DescribeBackup",
                "dynamodb:UpdateTable",
                "dynamodb:GetRecords",
                "dynamodb:DescribeTableReplicaAutoScaling",
                "dynamodb:DeleteItem",
                "dynamodb:CreateTableReplica",
                "dynamodb:ListTagsOfResource",
                "dynamodb:UpdateContributorInsights",
                "dynamodb:CreateBackup",
                "dynamodb:UpdateContinuousBackups",
                "dynamodb:TagResource",
                "dynamodb:PartiQLSelect",
                "dynamodb:CreateGlobalTable",
                "dynamodb:DescribeKinesisStreamingDestination",
                "dynamodb:UntagResource",
                "dynamodb:ConditionCheckItem",
                "dynamodb:Query",
                "dynamodb:DescribeStream",
                "dynamodb:DeleteTableReplica",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:DescribeGlobalTableSettings",
                "dynamodb:DescribeGlobalTable",
                "dynamodb:RestoreTableFromBackup",
                "dynamodb:DeleteBackup",
                "dynamodb:PartiQLDelete"
            ],
            "Resource": "arn:aws:dynamodb:*:<account_id>:table/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::*",
                "arn:aws:s3:::*/*"
            ]
        }
    ]
}

IAM, CloudWatch

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:ListTagsForResource",
                "logs:ListTagsLogGroup",
                "logs:TagLogGroup",
                "logs:UntagLogGroup",
                "logs:DeleteLogGroup",
                "logs:PutRetentionPolicy",
                "logs:CreateLogGroup"
            ],
            "Resource": ["arn:aws:logs:*:<account_id>:log-group:/aws/lambda/sectigoawscm*",
            "arn:aws:logs:*:<account_id>:log-group::log-stream:*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:AttachRolePolicy",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyVersions",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeletePolicy",
                "iam:DeleteRole"
            ],
            "Resource": [
                "arn:aws:iam::<account_id>:role/sectigoawscm*",
                "arn:aws:iam::<account_id>:policy/sectigoawscm*",
                "arn:aws:iam::<account_id>:policy/lambda-logging-sectigoawscm*"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeRegions"
            ],
            "Resource": "*"
        }
    ]
}

Target accounts

The configuration in this section is required only if you use the aws_targets request parameter to push a single certificate into multiple AWS accounts or regions.

In each AWS account that should receive imports from the central connector, deploy the SectigoAWSCM-CrossAccountTarget CloudFormation template shipped with the release using the following command:

aws cloudformation deploy \
  --stack-name SectigoAWSCM-CrossAccountTarget \
  --template-file sectigo_awscm_iac/cloudformation/cross-account-role.yaml \
  --parameter-overrides CentralAccountId=<central-aws-account-id> \
                        CentralLambdaRoleName=<central-lambda-execution-role> \
  --capabilities CAPABILITY_NAMED_IAM \
  --profile <target-account-profile> \
  --region <target-region>

The --profile <target-account-profile> is required only when using a non-default AWS profile.

The CentralLambdaRoleName parameter must match the value of the lambda_role parameter displayed in the install.sh output.

The template creates an IAM role named SectigoAWSCM-CrossAccountTarget in the target account with the following ACM permissions the connector needs:

  • acm:ImportCertificate

  • acm:AddTagsToCertificate

  • acm:ListTagsForCertificate

  • acm:DescribeCertificate

  • acm:GetCertificate

  • acm:ListCertificates

  • tag:GetResources