How do I install the AWS Private Ca Issuer Review skill?

Run npx skillmds@latest add aibot88/aws-private-ca-issuer-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AWS Private Ca Issuer Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AWS Private Ca Issuer Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AWS Private Ca Issuer Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AWS Private Ca Issuer Review?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AWS Private Ca Issuer Review by aibot88

Name: AWS Private Ca Issuer Review
Rating: 4.2 (5 reviews)
Author: aibot88

AWS Private Ca Issuer Review

Use this skill when reviewing AWS ACM Private CA (Private Certificate Authority) issuer configurations for cert-manager. Trigger on any request to audit AWSPCAIssuer, AWSPCAClusterIssuer, IRSA policy for cert-manager, certificate template ARNs, CRL configuration, or cross-account PCA usage.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

AWS Private CA Issuer Review

Purpose

Review AWS ACM Private Certificate Authority configurations used by the cert-manager aws-privateca-issuer plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks.

Lean operating rules

Flag any AWSPCAIssuer referencing a ROOT CA ARN directly as CRITICAL — only a SUBORDINATE CA should be active for cert-manager issuance.
Check spec.template.arn: flag any SubordinateCACertificate template as CRITICAL (allows cert-manager to mint sub-CAs). Correct template is EndEntityCertificate/V1.
Review IRSA role policy: required actions are acm-pca:IssueCertificate, acm-pca:GetCertificate, acm-pca:DescribeCertificateAuthority. Flag acm-pca:DeleteCertificateAuthority or acm-pca:CreateCertificateAuthority as HIGH.
Review spec.duration in Certificate resources; flag durations > 365d for workload certs as MEDIUM; best practice is <= 90d.
Check CRL S3 bucket reachability from within the VPC; flag unreachable CRL distribution points as HIGH (revocation disabled).
For cross-account PCA (RAM-shared CA): verify minimum issuance-only permissions in the security account.
Label all claims as live evidence, documentation-based, or inference.

References

Load these only when needed:

Workflow and output contract
Safety checklist
Official sources

Response minimum

Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
Evidence source for each finding
Specific resource name or field path
Recommended remediation with example policy or YAML snippet
Overall PKI trust posture verdict

---name: aws-private-ca-issuer-reviewdescription: Use this skill when reviewing AWS ACM Private CA (Private Certificate Authority) issuer configurations for cert-manager. Trigger on any request to audit AWSPCAIssuer, AWSPCAClusterIssuer, IRSA policy for cert-manager, certificate template ARNs, CRL configuration, or cross-account PCA usage.--- # AWS Private CA Issuer Review ## Purpose Review AWS ACM Private Certificate Authority configurations used by the cert-manager `aws-privateca-issuer` plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks. ## Lean operating rules - Flag any `AWSPCAIssuer` referencing a ROOT CA ARN directly as CRITICAL — only a SUBORDINATE CA should be active for cert-manager issuance. - Check `spec.template.arn`: flag any SubordinateCACertificate template as CRITICAL (allows cert-manager to mint sub-CAs). Correct template is `EndEntityCertificate/V1`. - Review IRSA role policy: required actions are `acm-pca:IssueCertificate`, `acm-pca:GetCertificate`, `acm-pca:DescribeCertificateAuthority`. Flag `acm-pca:DeleteCertificateAuthority` or `acm-pca:CreateCertificateAuthority` as HIGH. - Review `spec.duration` in Certificate resources; flag durations > 365d for workload certs as MEDIUM; best practice is <= 90d. - Check CRL S3 bucket reachability from within the VPC; flag unreachable CRL distribution points as HIGH (revocation disabled). - For cross-account PCA (RAM-shared CA): verify minimum issuance-only permissions in the security account. - Label all claims as live evidence, documentation-based, or inference. ## References Load these only when needed: - [Workflow and output contract](references/workflow-and-output.md) - [Safety checklist](references/safety-checklist.md) - [Official sources](references/official-sources.md) ## Response minimum - Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW) - Evidence source for each finding - Specific resource name or field path - Recommended remediation with example policy or YAML snippet - Overall PKI trust posture verdict

Frequently asked questions