Secure Kubernetes with AWS Private Certificate Authority - AWS Private Certificate Authority

View a markdown version of this page

Secure Kubernetes with AWS Private Certificate Authority - AWS Private Certificate Authority
Region availability

Secure Kubernetes with AWS Private Certificate Authority

You can use AWS Private Certificate Authority to provide certificates for secure authentication and encryption over TLS and mTLS. AWS Private CA provides an open source plugin, AWS Private CA Connector for Kubernetes, (aws-privateca-issuer) for the widely adopted cert-manager add-on to Kubernetes that requests certificates, distributes them to Kubernetes secrets, and automates certificate renewal.

The aws-privateca-issuer plugin allows you to issue AWS Private CA certificates through cert-manager. You can use the plugin with Amazon Elastic Kubernetes Service (Amazon EKS), a self-managed Kubernetes cluster on AWS, or in an on-premise Kubernetes cluster. The plugin works on both x86 and ARM architectures.

AWS Private CA has HSM backed keys that can't be exported. If you have regulatory requirements for controlling access and auditing your CA operations, you can use AWS Private CA to improve auditability and to support compliance.

Note

If you are running on Amazon EKS, we recommend that you use the cert-manager and aws-privateca-connector-for-kubernetes add-ons for a managed installation experience. For more information, refer to AWS add-ons.

Region availability

The AWS Private CA Connector for Kubernetes, including the managed aws-privateca-connector-for-kubernetes Amazon EKS add-on, is available in the AWS GovCloud (US) Regions:

  • AWS GovCloud (US-East)

  • AWS GovCloud (US-West)

In the AWS GovCloud (US) Regions, resource ARNs use the aws-us-gov partition. See AWS Private Certificate Authority in the AWS GovCloud (US) User Guide for Region-specific differences.