AWS：由于以下错误，ACM 无法自动续订证书：PCA_ACCESS_DENIED答案

【问题标题】：AWS: ACM was unable to renew the certificate automatically because of the following error: PCA_ACCESS_DENIEDAWS：由于以下错误，ACM 无法自动续订证书：PCA_ACCESS_DENIED
【发布时间】：2022-07-16 00:43:26
【问题描述】：

我收到了来自 AWS 的证书过期警告消息。它包含这句话：

ACM was unable to renew the certificate automatically because of the following error: PCA_ACCESS_DENIED.

这是什么意思，我该如何解决？

【问题讨论】：

标签： amazon-web-services

【解决方案1】：

检查私有证书颁发机构并选择操作|配置 CA 权限。确保授权 ACM 访问以更新此帐户请求的证书。 已选中。

使用 AWS CLI (cloudshell) 运行以下命令：

aws acm-pca list-permissions --certificate-authority-arn "arn:aws:acm-pca:us-east-2:ACCOUNTNUMBER:certificate-authority/xxxxxxx-b0e1-446e-a2ec-6f6c466e4684"

如果你回来：

{
    "Permissions": []
}

这表明 CA 无权更新证书。

您的权限应类似于：

{
    "Permissions": [
        {
            "CertificateAuthorityArn": "arn:aws:acm-pca:us-east-2:338533562003:certificate-authority/xxxxxxx-b0e1-446e-a2ec-6f6c466e4684",
            "CreatedAt": "2022-07-15T16:21:51.890000+00:00",
            "Principal": "acm.amazonaws.com",
            "SourceAccount": "ACCOUNTNUMBER",
            "Actions": [
                "GetCertificate",
                "IssueCertificate",
                "ListPermissions"
            ],
            "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"1\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"acm.amazonaws.com\"},\"Action\":[\"acm-pca:GetCertificate\",\"acm-pca:IssueCertificate\",\"acm-pca:ListPermissions\"],\"Resource\":\"arn:aws:acm-pca:us-east-2:ACCOUNTNUMBER:certificate-authority/xxxxxxx-b0e1-446e-a2ec-6f6c466e4684\",\"Condition\":{\"StringEquals\":{\"aws:SourceAccount\":\"ACCOUNTNUMBER\"}}}]}"
        }
    ]
}

【讨论】：