Control: 1 AWS Private CA root certificate authority should be disabled
Description
This control checks if AWS Private CA has a root certificate authority (CA) that is disabled. The control fails if the root CA is enabled.
With AWS Private CA, you can create a CA hierarchy that includes a root CA and subordinate CAs. You should minimize the use of the root CA for daily tasks, especially in production environments. The root CA should only be used to issue certificates for intermediate CAs. This allows the root CA to be stored out of harm's way while the intermediate CAs perform the daily task of issuing end-entity certificates.
Remediation
To disable the root CA, see Update CA status in the AWS Private Certificate Authority User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_pca_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_pca_1 --shareSQL
This control uses a named query:
acmpca_root_certificate_authority_disabled