agentsclimarketplace

Aws private ca issuer review

Skill Raishin/vanguard-frontier-agentic/skills/aws/aws-private-ca-issuer-review

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill aws-private-ca-issuer-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use this skill when reviewing AWS ACM Private CA (Private Certificate Authority) issuer configurations for cert-manager. Trigger on any request to audit AWSPCAIssuer, AWSPCAClusterIssuer, IRSA policy for cert-manager, certificate template ARNs, CRL configuration, or cross-account PCA usage.

SKILL.md

2.5 KB, 444 tokens by cl100k_base, as published. Nobody here has run it

AWS Private CA Issuer Review

Purpose

Review AWS ACM Private Certificate Authority configurations used by the cert-manager aws-privateca-issuer plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks.

Lean operating rules

  • Flag any AWSPCAIssuer referencing a ROOT CA ARN directly as CRITICAL — only a SUBORDINATE CA should be active for cert-manager issuance.
  • Check spec.template.arn: flag any SubordinateCACertificate template as CRITICAL (allows cert-manager to mint sub-CAs). Correct template is EndEntityCertificate/V1.
  • Review IRSA role policy: required actions are acm-pca:IssueCertificate, acm-pca:GetCertificate, acm-pca:DescribeCertificateAuthority. Flag acm-pca:DeleteCertificateAuthority or acm-pca:CreateCertificateAuthority as HIGH.
  • Review spec.duration in Certificate resources; flag durations > 365d for workload certs as MEDIUM; best practice is <= 90d.
  • Check CRL S3 bucket reachability from within the VPC; flag unreachable CRL distribution points as HIGH (revocation disabled).
  • For cross-account PCA (RAM-shared CA): verify minimum issuance-only permissions in the security account.
  • Label all claims as live evidence, documentation-based, or inference.

References

Load these only when needed:

Response minimum

  • Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
  • Evidence source for each finding
  • Specific resource name or field path
  • Recommended remediation with example policy or YAML snippet
  • Overall PKI trust posture verdict

What ships with it: 5 files

15.1 KB alongside SKILL.md

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.