AWS

AWS Certificate Manager extends ACME public certificate issuance to work over AWS PrivateLink, keeping traffic within the AWS network. Users can create a VPC interface endpoint for the ACM ACME service, allowing any ACMEv2-compatible client to route requests through the VPC. Existing client configurations and directory URLs continue to function without modification, as Private DNS automatically resolves to the new interface endpoint.

• Route ACME public certificate issuance over private VPC paths via AWS PrivateLink.
• No code or config changes required for existing ACMEv2-compatible clients.
• Private DNS automatically resolves the ACME directory URL to the interface endpoint.
• Create the managed endpoint in ACM, then provision a standard VPC interface endpoint.

AWS Private CA now emits a new CloudTrail event, IssueCertificateDetails, that captures the complete to-be-signed certificate content, issuing CA info, requester identity, and signing status for every issuance. This replaces the previous limited management event which only confirmed API success with an ARN and missed failed attempts or certificate payload details. The enhancement supports compliance auditing, inventory management, algorithm migration tracking, and monitoring of failed issuance attempts.

• IssueCertificateDetails event captures full X.509 fields and extensions in CloudTrail logs.
• Enables auditing of failed issuance attempts that were previously invisible in management events.
• Simplifies certificate inventory and algorithm migration tracking with complete payload data.
• Replaces the prior IssueCertificate event which lacked content and failure details.
• Use these logs for compliance auditing and monitoring CA signing status.

AWS Client VPN now integrates with third-party posture providers like CrowdStrike and Jamf to verify device security before granting network access. This capability extends beyond previous certificate or SAML authentication by evaluating real-time signals such as encryption status and compliance scores. Administrators define granular access rules using Cedar policies to ensure only trusted devices reach AWS resources.

• Integrates with CrowdStrike, Jamf, and JumpCloud for automated device trust verification.
• Uses Cedar policies to define fine-grained access rules based on device security signals.
• Adds a layer of endpoint validation beyond existing user authentication methods.
• Enforces compliance requirements like encryption status before allowing network connectivity.