amazonka-certificatemanager-pca 1.6.1 → 2.0

raw patch · 117 files changed

+13231/−4533 lines, 117 filesdep +case-insensitivedep ~amazonka-coredep ~amazonka-testdep ~basesetup-changedPVP ok

version bump matches the API change (PVP)

Dependencies added: case-insensitive

Dependency ranges changed: amazonka-core, amazonka-test, base

API changes (from Hackage documentation)

Files

• README.md +3/−4
• Setup.hs +0/−2
• amazonka-certificatemanager-pca.cabal +138/−90
• fixture/CreatePermission.yaml +10/−0
• fixture/CreatePermissionResponse.proto +0/−0
• fixture/DeletePermission.yaml +10/−0
• fixture/DeletePermissionResponse.proto +0/−0
• fixture/DeletePolicy.yaml +10/−0
• fixture/DeletePolicyResponse.proto +0/−0
• fixture/GetCertificateAuthorityCSR.yaml +0/−10
• fixture/GetCertificateAuthorityCSRResponse.proto +0/−0
• fixture/GetCertificateAuthorityCsr.yaml +10/−0
• fixture/GetCertificateAuthorityCsrResponse.proto +0/−0
• fixture/GetPolicy.yaml +10/−0
• fixture/GetPolicyResponse.proto +0/−0
• fixture/ListPermissions.yaml +10/−0
• fixture/ListPermissionsResponse.proto +0/−0
• fixture/PutPolicy.yaml +10/−0
• fixture/PutPolicyResponse.proto +0/−0
• fixture/RestoreCertificateAuthority.yaml +10/−0
• fixture/RestoreCertificateAuthorityResponse.proto +0/−0
• gen/Amazonka/CertificateManagerPCA.hs +460/−0
• gen/Amazonka/CertificateManagerPCA/CreateCertificateAuthority.hs +481/−0
• gen/Amazonka/CertificateManagerPCA/CreateCertificateAuthorityAuditReport.hs +285/−0
• gen/Amazonka/CertificateManagerPCA/CreatePermission.hs +240/−0
• gen/Amazonka/CertificateManagerPCA/DeleteCertificateAuthority.hs +209/−0
• gen/Amazonka/CertificateManagerPCA/DeletePermission.hs +221/−0
• gen/Amazonka/CertificateManagerPCA/DeletePolicy.hs +175/−0
• gen/Amazonka/CertificateManagerPCA/DescribeCertificateAuthority.hs +228/−0
• gen/Amazonka/CertificateManagerPCA/DescribeCertificateAuthorityAuditReport.hs +288/−0
• gen/Amazonka/CertificateManagerPCA/GetCertificate.hs +243/−0
• gen/Amazonka/CertificateManagerPCA/GetCertificateAuthorityCertificate.hs +237/−0
• gen/Amazonka/CertificateManagerPCA/GetCertificateAuthorityCsr.hs +203/−0
• gen/Amazonka/CertificateManagerPCA/GetPolicy.hs +198/−0
• gen/Amazonka/CertificateManagerPCA/ImportCertificateAuthorityCertificate.hs +353/−0
• gen/Amazonka/CertificateManagerPCA/IssueCertificate.hs +571/−0
• gen/Amazonka/CertificateManagerPCA/Lens.hs +354/−0
• gen/Amazonka/CertificateManagerPCA/ListCertificateAuthorities.hs +266/−0
• gen/Amazonka/CertificateManagerPCA/ListPermissions.hs +313/−0
• gen/Amazonka/CertificateManagerPCA/ListTags.hs +274/−0
• gen/Amazonka/CertificateManagerPCA/PutPolicy.hs +202/−0
• gen/Amazonka/CertificateManagerPCA/RestoreCertificateAuthority.hs +180/−0
• gen/Amazonka/CertificateManagerPCA/RevokeCertificate.hs +247/−0
• gen/Amazonka/CertificateManagerPCA/TagCertificateAuthority.hs +192/−0
• gen/Amazonka/CertificateManagerPCA/Types.hs +549/−0
• gen/Amazonka/CertificateManagerPCA/Types/ASN1Subject.hs +338/−0
• gen/Amazonka/CertificateManagerPCA/Types/AccessDescription.hs +102/−0
• gen/Amazonka/CertificateManagerPCA/Types/AccessMethod.hs +107/−0
• gen/Amazonka/CertificateManagerPCA/Types/AccessMethodType.hs +76/−0
• gen/Amazonka/CertificateManagerPCA/Types/ActionType.hs +76/−0
• gen/Amazonka/CertificateManagerPCA/Types/ApiPassthrough.hs +91/−0
• gen/Amazonka/CertificateManagerPCA/Types/AuditReportResponseFormat.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/AuditReportStatus.hs +76/−0
• gen/Amazonka/CertificateManagerPCA/Types/CertificateAuthority.hs +322/−0
• gen/Amazonka/CertificateManagerPCA/Types/CertificateAuthorityConfiguration.hs +176/−0
• gen/Amazonka/CertificateManagerPCA/Types/CertificateAuthorityStatus.hs +96/−0
• gen/Amazonka/CertificateManagerPCA/Types/CertificateAuthorityType.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/CertificateAuthorityUsageMode.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/CrlConfiguration.hs +334/−0
• gen/Amazonka/CertificateManagerPCA/Types/CsrExtensions.hs +115/−0
• gen/Amazonka/CertificateManagerPCA/Types/CustomAttribute.hs +102/−0
• gen/Amazonka/CertificateManagerPCA/Types/CustomExtension.hs +109/−0
• gen/Amazonka/CertificateManagerPCA/Types/EdiPartyName.hs +98/−0
• gen/Amazonka/CertificateManagerPCA/Types/ExtendedKeyUsage.hs +91/−0
• gen/Amazonka/CertificateManagerPCA/Types/ExtendedKeyUsageType.hs +106/−0
• gen/Amazonka/CertificateManagerPCA/Types/Extensions.hs +172/−0
• gen/Amazonka/CertificateManagerPCA/Types/FailureReason.hs +76/−0
• gen/Amazonka/CertificateManagerPCA/Types/GeneralName.hs +180/−0
• gen/Amazonka/CertificateManagerPCA/Types/KeyAlgorithm.hs +81/−0
• gen/Amazonka/CertificateManagerPCA/Types/KeyStorageSecurityStandard.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/KeyUsage.hs +189/−0
• gen/Amazonka/CertificateManagerPCA/Types/OcspConfiguration.hs +140/−0
• gen/Amazonka/CertificateManagerPCA/Types/OtherName.hs +96/−0
• gen/Amazonka/CertificateManagerPCA/Types/Permission.hs +152/−0
• gen/Amazonka/CertificateManagerPCA/Types/PolicyInformation.hs +103/−0
• gen/Amazonka/CertificateManagerPCA/Types/PolicyQualifierId.hs +66/−0
• gen/Amazonka/CertificateManagerPCA/Types/PolicyQualifierInfo.hs +98/−0
• gen/Amazonka/CertificateManagerPCA/Types/Qualifier.hs +73/−0
• gen/Amazonka/CertificateManagerPCA/Types/ResourceOwner.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/RevocationConfiguration.hs +129/−0
• gen/Amazonka/CertificateManagerPCA/Types/RevocationReason.hs +101/−0
• gen/Amazonka/CertificateManagerPCA/Types/S3ObjectAcl.hs +71/−0
• gen/Amazonka/CertificateManagerPCA/Types/SigningAlgorithm.hs +91/−0
• gen/Amazonka/CertificateManagerPCA/Types/Tag.hs +98/−0
• gen/Amazonka/CertificateManagerPCA/Types/Validity.hs +198/−0
• gen/Amazonka/CertificateManagerPCA/Types/ValidityPeriodType.hs +86/−0
• gen/Amazonka/CertificateManagerPCA/UntagCertificateAuthority.hs +183/−0
• gen/Amazonka/CertificateManagerPCA/UpdateCertificateAuthority.hs +268/−0
• gen/Amazonka/CertificateManagerPCA/Waiters.hs +83/−0
• gen/Network/AWS/CertificateManagerPCA.hs +0/−275
• gen/Network/AWS/CertificateManagerPCA/CreateCertificateAuthority.hs +0/−178
• gen/Network/AWS/CertificateManagerPCA/CreateCertificateAuthorityAuditReport.hs +0/−188
• gen/Network/AWS/CertificateManagerPCA/DeleteCertificateAuthority.hs +0/−116
• gen/Network/AWS/CertificateManagerPCA/DescribeCertificateAuthority.hs +0/−157
• gen/Network/AWS/CertificateManagerPCA/DescribeCertificateAuthorityAuditReport.hs +0/−198
• gen/Network/AWS/CertificateManagerPCA/GetCertificate.hs +0/−160
• gen/Network/AWS/CertificateManagerPCA/GetCertificateAuthorityCSR.hs +0/−139
• gen/Network/AWS/CertificateManagerPCA/GetCertificateAuthorityCertificate.hs +0/−160
• gen/Network/AWS/CertificateManagerPCA/ImportCertificateAuthorityCertificate.hs +0/−153
• gen/Network/AWS/CertificateManagerPCA/IssueCertificate.hs +0/−180
• gen/Network/AWS/CertificateManagerPCA/ListCertificateAuthorities.hs +0/−158
• gen/Network/AWS/CertificateManagerPCA/ListTags.hs +0/−169
• gen/Network/AWS/CertificateManagerPCA/RevokeCertificate.hs +0/−135
• gen/Network/AWS/CertificateManagerPCA/TagCertificateAuthority.hs +0/−127
• gen/Network/AWS/CertificateManagerPCA/Types.hs +0/−300
• gen/Network/AWS/CertificateManagerPCA/Types/Product.hs +0/−647
• gen/Network/AWS/CertificateManagerPCA/Types/Sum.hs +0/−335
• gen/Network/AWS/CertificateManagerPCA/UntagCertificateAuthority.hs +0/−128
• gen/Network/AWS/CertificateManagerPCA/UpdateCertificateAuthority.hs +0/−138
• gen/Network/AWS/CertificateManagerPCA/Waiters.hs +0/−21
• test/Main.hs +11/−9
• test/Test/AWS/CertificateManagerPCA.hs +0/−20
• test/Test/AWS/CertificateManagerPCA/Internal.hs +0/−9
• test/Test/AWS/Gen/CertificateManagerPCA.hs +0/−327
• test/Test/Amazonka/CertificateManagerPCA.hs +20/−0
• test/Test/Amazonka/CertificateManagerPCA/Internal.hs +8/−0
• test/Test/Amazonka/Gen/CertificateManagerPCA.hs +498/−0

@@ -7,9 +7,8 @@   ## Version--`1.6.1`-+ +`2.0` - Derived from API version @2017-08-22@ of the AWS service descriptions, licensed under Apache 2.0.  ## Description @@ -26,7 +25,7 @@ The provided lenses should be compatible with any of the major lens libraries [lens](http://hackage.haskell.org/package/lens) or [lens-family-core](http://hackage.haskell.org/package/lens-family-core). -See [Network.AWS.CertificateManagerPCA](http://hackage.haskell.org/package/amazonka-certificatemanager-pca/docs/Network-AWS-CertificateManagerPCA.html)+See [Amazonka.CertificateManagerPCA](http://hackage.haskell.org/package/amazonka-certificatemanager-pca/docs/Amazonka-CertificateManagerPCA.html) or [the AWS documentation](https://aws.amazon.com/documentation/) to get started.  

@@ -1,2 +0,0 @@-import           Distribution.Simple-main = defaultMain

@@ -1,101 +1,149 @@-name:                  amazonka-certificatemanager-pca-version:               1.6.1-synopsis:              Amazon Certificate Manager Private Certificate Authority SDK.-homepage:              https://github.com/brendanhay/amazonka-bug-reports:           https://github.com/brendanhay/amazonka/issues-license:               MPL-2.0-license-file:          LICENSE-author:                Brendan Hay-maintainer:            Brendan Hay <brendan.g.hay+amazonka@gmail.com>-copyright:             Copyright (c) 2013-2018 Brendan Hay-category:              Network, AWS, Cloud, Distributed Computing-build-type:            Simple-cabal-version:         >= 1.10-extra-source-files:    README.md fixture/*.yaml fixture/*.proto src/.gitkeep+cabal-version:      2.2+name:               amazonka-certificatemanager-pca+version:            2.0+synopsis:+  Amazon Certificate Manager Private Certificate Authority SDK.++homepage:           https://github.com/brendanhay/amazonka+bug-reports:        https://github.com/brendanhay/amazonka/issues+license:            MPL-2.0+license-file:       LICENSE+author:             Brendan Hay+maintainer:+  Brendan Hay <brendan.g.hay+amazonka@gmail.com>, Jack Kelly <jack@jackkelly.name>++copyright:          Copyright (c) 2013-2023 Brendan Hay+category:           AWS+build-type:         Simple+extra-source-files:+  fixture/*.proto+  fixture/*.yaml+  README.md+  src/.gitkeep+ description:-    The types from this library are intended to be used with-    <http://hackage.haskell.org/package/amazonka amazonka>, which provides-    mechanisms for specifying AuthN/AuthZ information, sending requests,-    and receiving responses.-    .-    Lenses are used for constructing and manipulating types,-    due to the depth of nesting of AWS types and transparency regarding-    de/serialisation into more palatable Haskell values.-    The provided lenses should be compatible with any of the major lens libraries-    such as <http://hackage.haskell.org/package/lens lens> or-    <http://hackage.haskell.org/package/lens-family-core lens-family-core>.-    .-    See "Network.AWS.CertificateManagerPCA" or <https://aws.amazon.com/documentation/ the AWS documentation>-    to get started.+  Derived from API version @2017-08-22@ of the AWS service descriptions, licensed under Apache 2.0.+  .+  The types from this library are intended to be used with <http://hackage.haskell.org/package/amazonka amazonka>,+  which provides mechanisms for specifying AuthN/AuthZ information, sending requests, and receiving responses.+  .+  It is recommended to use generic lenses or optics from packages such as <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify optional fields and deconstruct responses.+  .+  Generated lenses can be found in "Amazonka.CertificateManagerPCA.Lens" and are+  suitable for use with a lens package such as <http://hackage.haskell.org/package/lens lens> or <http://hackage.haskell.org/package/lens-family-core lens-family-core>.+  .+  See "Amazonka.CertificateManagerPCA" and the <https://aws.amazon.com/documentation/ AWS documentation> to get started.  source-repository head-    type:              git-    location:          git://github.com/brendanhay/amazonka.git-    subdir:            amazonka-certificatemanager-pca+  type:     git+  location: git://github.com/brendanhay/amazonka.git+  subdir:   amazonka-certificatemanager-pca  library-    default-language:  Haskell2010-    hs-source-dirs:    src gen--    ghc-options:-        -Wall-        -fwarn-incomplete-uni-patterns-        -fwarn-incomplete-record-updates-        -funbox-strict-fields--    exposed-modules:-          Network.AWS.CertificateManagerPCA-        , Network.AWS.CertificateManagerPCA.CreateCertificateAuthority-        , Network.AWS.CertificateManagerPCA.CreateCertificateAuthorityAuditReport-        , Network.AWS.CertificateManagerPCA.DeleteCertificateAuthority-        , Network.AWS.CertificateManagerPCA.DescribeCertificateAuthority-        , Network.AWS.CertificateManagerPCA.DescribeCertificateAuthorityAuditReport-        , Network.AWS.CertificateManagerPCA.GetCertificate-        , Network.AWS.CertificateManagerPCA.GetCertificateAuthorityCSR-        , Network.AWS.CertificateManagerPCA.GetCertificateAuthorityCertificate-        , Network.AWS.CertificateManagerPCA.ImportCertificateAuthorityCertificate-        , Network.AWS.CertificateManagerPCA.IssueCertificate-        , Network.AWS.CertificateManagerPCA.ListCertificateAuthorities-        , Network.AWS.CertificateManagerPCA.ListTags-        , Network.AWS.CertificateManagerPCA.RevokeCertificate-        , Network.AWS.CertificateManagerPCA.TagCertificateAuthority-        , Network.AWS.CertificateManagerPCA.Types-        , Network.AWS.CertificateManagerPCA.UntagCertificateAuthority-        , Network.AWS.CertificateManagerPCA.UpdateCertificateAuthority-        , Network.AWS.CertificateManagerPCA.Waiters+  default-language: Haskell2010+  hs-source-dirs:   src gen+  ghc-options:+    -Wall -fwarn-incomplete-uni-patterns+    -fwarn-incomplete-record-updates -funbox-strict-fields -    other-modules:-          Network.AWS.CertificateManagerPCA.Types.Product-        , Network.AWS.CertificateManagerPCA.Types.Sum+  exposed-modules:+    Amazonka.CertificateManagerPCA+    Amazonka.CertificateManagerPCA.CreateCertificateAuthority+    Amazonka.CertificateManagerPCA.CreateCertificateAuthorityAuditReport+    Amazonka.CertificateManagerPCA.CreatePermission+    Amazonka.CertificateManagerPCA.DeleteCertificateAuthority+    Amazonka.CertificateManagerPCA.DeletePermission+    Amazonka.CertificateManagerPCA.DeletePolicy+    Amazonka.CertificateManagerPCA.DescribeCertificateAuthority+    Amazonka.CertificateManagerPCA.DescribeCertificateAuthorityAuditReport+    Amazonka.CertificateManagerPCA.GetCertificate+    Amazonka.CertificateManagerPCA.GetCertificateAuthorityCertificate+    Amazonka.CertificateManagerPCA.GetCertificateAuthorityCsr+    Amazonka.CertificateManagerPCA.GetPolicy+    Amazonka.CertificateManagerPCA.ImportCertificateAuthorityCertificate+    Amazonka.CertificateManagerPCA.IssueCertificate+    Amazonka.CertificateManagerPCA.Lens+    Amazonka.CertificateManagerPCA.ListCertificateAuthorities+    Amazonka.CertificateManagerPCA.ListPermissions+    Amazonka.CertificateManagerPCA.ListTags+    Amazonka.CertificateManagerPCA.PutPolicy+    Amazonka.CertificateManagerPCA.RestoreCertificateAuthority+    Amazonka.CertificateManagerPCA.RevokeCertificate+    Amazonka.CertificateManagerPCA.TagCertificateAuthority+    Amazonka.CertificateManagerPCA.Types+    Amazonka.CertificateManagerPCA.Types.AccessDescription+    Amazonka.CertificateManagerPCA.Types.AccessMethod+    Amazonka.CertificateManagerPCA.Types.AccessMethodType+    Amazonka.CertificateManagerPCA.Types.ActionType+    Amazonka.CertificateManagerPCA.Types.ApiPassthrough+    Amazonka.CertificateManagerPCA.Types.ASN1Subject+    Amazonka.CertificateManagerPCA.Types.AuditReportResponseFormat+    Amazonka.CertificateManagerPCA.Types.AuditReportStatus+    Amazonka.CertificateManagerPCA.Types.CertificateAuthority+    Amazonka.CertificateManagerPCA.Types.CertificateAuthorityConfiguration+    Amazonka.CertificateManagerPCA.Types.CertificateAuthorityStatus+    Amazonka.CertificateManagerPCA.Types.CertificateAuthorityType+    Amazonka.CertificateManagerPCA.Types.CertificateAuthorityUsageMode+    Amazonka.CertificateManagerPCA.Types.CrlConfiguration+    Amazonka.CertificateManagerPCA.Types.CsrExtensions+    Amazonka.CertificateManagerPCA.Types.CustomAttribute+    Amazonka.CertificateManagerPCA.Types.CustomExtension+    Amazonka.CertificateManagerPCA.Types.EdiPartyName+    Amazonka.CertificateManagerPCA.Types.ExtendedKeyUsage+    Amazonka.CertificateManagerPCA.Types.ExtendedKeyUsageType+    Amazonka.CertificateManagerPCA.Types.Extensions+    Amazonka.CertificateManagerPCA.Types.FailureReason+    Amazonka.CertificateManagerPCA.Types.GeneralName+    Amazonka.CertificateManagerPCA.Types.KeyAlgorithm+    Amazonka.CertificateManagerPCA.Types.KeyStorageSecurityStandard+    Amazonka.CertificateManagerPCA.Types.KeyUsage+    Amazonka.CertificateManagerPCA.Types.OcspConfiguration+    Amazonka.CertificateManagerPCA.Types.OtherName+    Amazonka.CertificateManagerPCA.Types.Permission+    Amazonka.CertificateManagerPCA.Types.PolicyInformation+    Amazonka.CertificateManagerPCA.Types.PolicyQualifierId+    Amazonka.CertificateManagerPCA.Types.PolicyQualifierInfo+    Amazonka.CertificateManagerPCA.Types.Qualifier+    Amazonka.CertificateManagerPCA.Types.ResourceOwner+    Amazonka.CertificateManagerPCA.Types.RevocationConfiguration+    Amazonka.CertificateManagerPCA.Types.RevocationReason+    Amazonka.CertificateManagerPCA.Types.S3ObjectAcl+    Amazonka.CertificateManagerPCA.Types.SigningAlgorithm+    Amazonka.CertificateManagerPCA.Types.Tag+    Amazonka.CertificateManagerPCA.Types.Validity+    Amazonka.CertificateManagerPCA.Types.ValidityPeriodType+    Amazonka.CertificateManagerPCA.UntagCertificateAuthority+    Amazonka.CertificateManagerPCA.UpdateCertificateAuthority+    Amazonka.CertificateManagerPCA.Waiters -    build-depends:-          amazonka-core == 1.6.1.*-        , base          >= 4.7     && < 5+  build-depends:+    , amazonka-core  >=2.0  && <2.1+    , base           >=4.12 && <5  test-suite amazonka-certificatemanager-pca-test-    type:              exitcode-stdio-1.0-    default-language:  Haskell2010-    hs-source-dirs:    test-    main-is:           Main.hs--    ghc-options:       -Wall -threaded+  type:             exitcode-stdio-1.0+  default-language: Haskell2010+  hs-source-dirs:   test+  main-is:          Main.hs+  ghc-options:      -Wall -threaded -    -- This section is encoded by the template and any modules added by-    -- hand outside these namespaces will not correctly be added to the-    -- distribution package.-    other-modules:-          Test.AWS.CertificateManagerPCA-        , Test.AWS.Gen.CertificateManagerPCA-        , Test.AWS.CertificateManagerPCA.Internal+  -- This section is encoded by the template and any modules added by+  -- hand outside these namespaces will not correctly be added to the+  -- distribution package.+  other-modules:+    Test.Amazonka.CertificateManagerPCA+    Test.Amazonka.CertificateManagerPCA.Internal+    Test.Amazonka.Gen.CertificateManagerPCA -    build-depends:-          amazonka-core == 1.6.1.*-        , amazonka-test == 1.6.1.*-        , amazonka-certificatemanager-pca-        , base-        , bytestring-        , tasty-        , tasty-hunit-        , text-        , time-        , unordered-containers+  build-depends:+    , amazonka-certificatemanager-pca+    , amazonka-core                    >=2.0 && <2.1+    , amazonka-test                    >=2.0 && <2.1+    , base+    , bytestring+    , case-insensitive+    , tasty+    , tasty-hunit+    , text+    , time+    , unordered-containers

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -1,10 +0,0 @@-----method: POST-headers:-  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?-  Host:                  acm-pca.us-east-1.amazonaws.com-  Content-Type:          application/x-www-form-urlencoded; charset=utf-8-  X-Amz-Content-SHA256:  abcdef-  X-Amz-Date:            20091028T223200Z-body:-  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/acm-pca/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  acm-pca.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,460 @@+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}++-- |+-- Module      : Amazonka.CertificateManagerPCA+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Derived from API version @2017-08-22@ of the AWS service descriptions, licensed under Apache 2.0.+--+-- This is the /Amazon Web Services Private Certificate Authority API+-- Reference/. It provides descriptions, syntax, and usage examples for+-- each of the actions and data types involved in creating and managing a+-- private certificate authority (CA) for your organization.+--+-- The documentation for each action shows the API request parameters and+-- the JSON response. Alternatively, you can use one of the Amazon Web+-- Services SDKs to access an API that is tailored to the programming+-- language or platform that you prefer. For more information, see+-- <https://aws.amazon.com/tools/#SDKs Amazon Web Services SDKs>.+--+-- Each Amazon Web Services Private CA API operation has a quota that+-- determines the number of times the operation can be called per second.+-- Amazon Web Services Private CA throttles API requests at different rates+-- depending on the operation. Throttling means that Amazon Web Services+-- Private CA rejects an otherwise valid request because the request+-- exceeds the operation\'s quota for the number of requests per second.+-- When a request is throttled, Amazon Web Services Private CA returns a+-- <https://docs.aws.amazon.com/acm-pca/latest/APIReference/CommonErrors.html ThrottlingException>+-- error. Amazon Web Services Private CA does not guarantee a minimum+-- request rate for APIs.+--+-- To see an up-to-date list of your Amazon Web Services Private CA quotas,+-- or to request a quota increase, log into your Amazon Web Services+-- account and visit the+-- <https://console.aws.amazon.com/servicequotas/ Service Quotas> console.+module Amazonka.CertificateManagerPCA+  ( -- * Service Configuration+    defaultService,++    -- * Errors+    -- $errors++    -- ** CertificateMismatchException+    _CertificateMismatchException,++    -- ** ConcurrentModificationException+    _ConcurrentModificationException,++    -- ** InvalidArgsException+    _InvalidArgsException,++    -- ** InvalidArnException+    _InvalidArnException,++    -- ** InvalidNextTokenException+    _InvalidNextTokenException,++    -- ** InvalidPolicyException+    _InvalidPolicyException,++    -- ** InvalidRequestException+    _InvalidRequestException,++    -- ** InvalidStateException+    _InvalidStateException,++    -- ** InvalidTagException+    _InvalidTagException,++    -- ** LimitExceededException+    _LimitExceededException,++    -- ** LockoutPreventedException+    _LockoutPreventedException,++    -- ** MalformedCSRException+    _MalformedCSRException,++    -- ** MalformedCertificateException+    _MalformedCertificateException,++    -- ** PermissionAlreadyExistsException+    _PermissionAlreadyExistsException,++    -- ** RequestAlreadyProcessedException+    _RequestAlreadyProcessedException,++    -- ** RequestFailedException+    _RequestFailedException,++    -- ** RequestInProgressException+    _RequestInProgressException,++    -- ** ResourceNotFoundException+    _ResourceNotFoundException,++    -- ** TooManyTagsException+    _TooManyTagsException,++    -- * Waiters+    -- $waiters++    -- ** AuditReportCreated+    newAuditReportCreated,++    -- ** CertificateAuthorityCSRCreated+    newCertificateAuthorityCSRCreated,++    -- ** CertificateIssued+    newCertificateIssued,++    -- * Operations+    -- $operations++    -- ** CreateCertificateAuthority+    CreateCertificateAuthority (CreateCertificateAuthority'),+    newCreateCertificateAuthority,+    CreateCertificateAuthorityResponse (CreateCertificateAuthorityResponse'),+    newCreateCertificateAuthorityResponse,++    -- ** CreateCertificateAuthorityAuditReport+    CreateCertificateAuthorityAuditReport (CreateCertificateAuthorityAuditReport'),+    newCreateCertificateAuthorityAuditReport,+    CreateCertificateAuthorityAuditReportResponse (CreateCertificateAuthorityAuditReportResponse'),+    newCreateCertificateAuthorityAuditReportResponse,++    -- ** CreatePermission+    CreatePermission (CreatePermission'),+    newCreatePermission,+    CreatePermissionResponse (CreatePermissionResponse'),+    newCreatePermissionResponse,++    -- ** DeleteCertificateAuthority+    DeleteCertificateAuthority (DeleteCertificateAuthority'),+    newDeleteCertificateAuthority,+    DeleteCertificateAuthorityResponse (DeleteCertificateAuthorityResponse'),+    newDeleteCertificateAuthorityResponse,++    -- ** DeletePermission+    DeletePermission (DeletePermission'),+    newDeletePermission,+    DeletePermissionResponse (DeletePermissionResponse'),+    newDeletePermissionResponse,++    -- ** DeletePolicy+    DeletePolicy (DeletePolicy'),+    newDeletePolicy,+    DeletePolicyResponse (DeletePolicyResponse'),+    newDeletePolicyResponse,++    -- ** DescribeCertificateAuthority+    DescribeCertificateAuthority (DescribeCertificateAuthority'),+    newDescribeCertificateAuthority,+    DescribeCertificateAuthorityResponse (DescribeCertificateAuthorityResponse'),+    newDescribeCertificateAuthorityResponse,++    -- ** DescribeCertificateAuthorityAuditReport+    DescribeCertificateAuthorityAuditReport (DescribeCertificateAuthorityAuditReport'),+    newDescribeCertificateAuthorityAuditReport,+    DescribeCertificateAuthorityAuditReportResponse (DescribeCertificateAuthorityAuditReportResponse'),+    newDescribeCertificateAuthorityAuditReportResponse,++    -- ** GetCertificate+    GetCertificate (GetCertificate'),+    newGetCertificate,+    GetCertificateResponse (GetCertificateResponse'),+    newGetCertificateResponse,++    -- ** GetCertificateAuthorityCertificate+    GetCertificateAuthorityCertificate (GetCertificateAuthorityCertificate'),+    newGetCertificateAuthorityCertificate,+    GetCertificateAuthorityCertificateResponse (GetCertificateAuthorityCertificateResponse'),+    newGetCertificateAuthorityCertificateResponse,++    -- ** GetCertificateAuthorityCsr+    GetCertificateAuthorityCsr (GetCertificateAuthorityCsr'),+    newGetCertificateAuthorityCsr,+    GetCertificateAuthorityCsrResponse (GetCertificateAuthorityCsrResponse'),+    newGetCertificateAuthorityCsrResponse,++    -- ** GetPolicy+    GetPolicy (GetPolicy'),+    newGetPolicy,+    GetPolicyResponse (GetPolicyResponse'),+    newGetPolicyResponse,++    -- ** ImportCertificateAuthorityCertificate+    ImportCertificateAuthorityCertificate (ImportCertificateAuthorityCertificate'),+    newImportCertificateAuthorityCertificate,+    ImportCertificateAuthorityCertificateResponse (ImportCertificateAuthorityCertificateResponse'),+    newImportCertificateAuthorityCertificateResponse,++    -- ** IssueCertificate+    IssueCertificate (IssueCertificate'),+    newIssueCertificate,+    IssueCertificateResponse (IssueCertificateResponse'),+    newIssueCertificateResponse,++    -- ** ListCertificateAuthorities (Paginated)+    ListCertificateAuthorities (ListCertificateAuthorities'),+    newListCertificateAuthorities,+    ListCertificateAuthoritiesResponse (ListCertificateAuthoritiesResponse'),+    newListCertificateAuthoritiesResponse,++    -- ** ListPermissions (Paginated)+    ListPermissions (ListPermissions'),+    newListPermissions,+    ListPermissionsResponse (ListPermissionsResponse'),+    newListPermissionsResponse,++    -- ** ListTags (Paginated)+    ListTags (ListTags'),+    newListTags,+    ListTagsResponse (ListTagsResponse'),+    newListTagsResponse,++    -- ** PutPolicy+    PutPolicy (PutPolicy'),+    newPutPolicy,+    PutPolicyResponse (PutPolicyResponse'),+    newPutPolicyResponse,++    -- ** RestoreCertificateAuthority+    RestoreCertificateAuthority (RestoreCertificateAuthority'),+    newRestoreCertificateAuthority,+    RestoreCertificateAuthorityResponse (RestoreCertificateAuthorityResponse'),+    newRestoreCertificateAuthorityResponse,++    -- ** RevokeCertificate+    RevokeCertificate (RevokeCertificate'),+    newRevokeCertificate,+    RevokeCertificateResponse (RevokeCertificateResponse'),+    newRevokeCertificateResponse,++    -- ** TagCertificateAuthority+    TagCertificateAuthority (TagCertificateAuthority'),+    newTagCertificateAuthority,+    TagCertificateAuthorityResponse (TagCertificateAuthorityResponse'),+    newTagCertificateAuthorityResponse,++    -- ** UntagCertificateAuthority+    UntagCertificateAuthority (UntagCertificateAuthority'),+    newUntagCertificateAuthority,+    UntagCertificateAuthorityResponse (UntagCertificateAuthorityResponse'),+    newUntagCertificateAuthorityResponse,++    -- ** UpdateCertificateAuthority+    UpdateCertificateAuthority (UpdateCertificateAuthority'),+    newUpdateCertificateAuthority,+    UpdateCertificateAuthorityResponse (UpdateCertificateAuthorityResponse'),+    newUpdateCertificateAuthorityResponse,++    -- * Types++    -- ** AccessMethodType+    AccessMethodType (..),++    -- ** ActionType+    ActionType (..),++    -- ** AuditReportResponseFormat+    AuditReportResponseFormat (..),++    -- ** AuditReportStatus+    AuditReportStatus (..),++    -- ** CertificateAuthorityStatus+    CertificateAuthorityStatus (..),++    -- ** CertificateAuthorityType+    CertificateAuthorityType (..),++    -- ** CertificateAuthorityUsageMode+    CertificateAuthorityUsageMode (..),++    -- ** ExtendedKeyUsageType+    ExtendedKeyUsageType (..),++    -- ** FailureReason+    FailureReason (..),++    -- ** KeyAlgorithm+    KeyAlgorithm (..),++    -- ** KeyStorageSecurityStandard+    KeyStorageSecurityStandard (..),++    -- ** PolicyQualifierId+    PolicyQualifierId (..),++    -- ** ResourceOwner+    ResourceOwner (..),++    -- ** RevocationReason+    RevocationReason (..),++    -- ** S3ObjectAcl+    S3ObjectAcl (..),++    -- ** SigningAlgorithm+    SigningAlgorithm (..),++    -- ** ValidityPeriodType+    ValidityPeriodType (..),++    -- ** ASN1Subject+    ASN1Subject (ASN1Subject'),+    newASN1Subject,++    -- ** AccessDescription+    AccessDescription (AccessDescription'),+    newAccessDescription,++    -- ** AccessMethod+    AccessMethod (AccessMethod'),+    newAccessMethod,++    -- ** ApiPassthrough+    ApiPassthrough (ApiPassthrough'),+    newApiPassthrough,++    -- ** CertificateAuthority+    CertificateAuthority (CertificateAuthority'),+    newCertificateAuthority,++    -- ** CertificateAuthorityConfiguration+    CertificateAuthorityConfiguration (CertificateAuthorityConfiguration'),+    newCertificateAuthorityConfiguration,++    -- ** CrlConfiguration+    CrlConfiguration (CrlConfiguration'),+    newCrlConfiguration,++    -- ** CsrExtensions+    CsrExtensions (CsrExtensions'),+    newCsrExtensions,++    -- ** CustomAttribute+    CustomAttribute (CustomAttribute'),+    newCustomAttribute,++    -- ** CustomExtension+    CustomExtension (CustomExtension'),+    newCustomExtension,++    -- ** EdiPartyName+    EdiPartyName (EdiPartyName'),+    newEdiPartyName,++    -- ** ExtendedKeyUsage+    ExtendedKeyUsage (ExtendedKeyUsage'),+    newExtendedKeyUsage,++    -- ** Extensions+    Extensions (Extensions'),+    newExtensions,++    -- ** GeneralName+    GeneralName (GeneralName'),+    newGeneralName,++    -- ** KeyUsage+    KeyUsage (KeyUsage'),+    newKeyUsage,++    -- ** OcspConfiguration+    OcspConfiguration (OcspConfiguration'),+    newOcspConfiguration,++    -- ** OtherName+    OtherName (OtherName'),+    newOtherName,++    -- ** Permission+    Permission (Permission'),+    newPermission,++    -- ** PolicyInformation+    PolicyInformation (PolicyInformation'),+    newPolicyInformation,++    -- ** PolicyQualifierInfo+    PolicyQualifierInfo (PolicyQualifierInfo'),+    newPolicyQualifierInfo,++    -- ** Qualifier+    Qualifier (Qualifier'),+    newQualifier,++    -- ** RevocationConfiguration+    RevocationConfiguration (RevocationConfiguration'),+    newRevocationConfiguration,++    -- ** Tag+    Tag (Tag'),+    newTag,++    -- ** Validity+    Validity (Validity'),+    newValidity,+  )+where++import Amazonka.CertificateManagerPCA.CreateCertificateAuthority+import Amazonka.CertificateManagerPCA.CreateCertificateAuthorityAuditReport+import Amazonka.CertificateManagerPCA.CreatePermission+import Amazonka.CertificateManagerPCA.DeleteCertificateAuthority+import Amazonka.CertificateManagerPCA.DeletePermission+import Amazonka.CertificateManagerPCA.DeletePolicy+import Amazonka.CertificateManagerPCA.DescribeCertificateAuthority+import Amazonka.CertificateManagerPCA.DescribeCertificateAuthorityAuditReport+import Amazonka.CertificateManagerPCA.GetCertificate+import Amazonka.CertificateManagerPCA.GetCertificateAuthorityCertificate+import Amazonka.CertificateManagerPCA.GetCertificateAuthorityCsr+import Amazonka.CertificateManagerPCA.GetPolicy+import Amazonka.CertificateManagerPCA.ImportCertificateAuthorityCertificate+import Amazonka.CertificateManagerPCA.IssueCertificate+import Amazonka.CertificateManagerPCA.Lens+import Amazonka.CertificateManagerPCA.ListCertificateAuthorities+import Amazonka.CertificateManagerPCA.ListPermissions+import Amazonka.CertificateManagerPCA.ListTags+import Amazonka.CertificateManagerPCA.PutPolicy+import Amazonka.CertificateManagerPCA.RestoreCertificateAuthority+import Amazonka.CertificateManagerPCA.RevokeCertificate+import Amazonka.CertificateManagerPCA.TagCertificateAuthority+import Amazonka.CertificateManagerPCA.Types+import Amazonka.CertificateManagerPCA.UntagCertificateAuthority+import Amazonka.CertificateManagerPCA.UpdateCertificateAuthority+import Amazonka.CertificateManagerPCA.Waiters++-- $errors+-- Error matchers are designed for use with the functions provided by+-- <http://hackage.haskell.org/package/lens/docs/Control-Exception-Lens.html Control.Exception.Lens>.+-- This allows catching (and rethrowing) service specific errors returned+-- by 'CertificateManagerPCA'.++-- $operations+-- Some AWS operations return results that are incomplete and require subsequent+-- requests in order to obtain the entire result set. The process of sending+-- subsequent requests to continue where a previous request left off is called+-- pagination. For example, the 'ListObjects' operation of Amazon S3 returns up to+-- 1000 objects at a time, and you must send subsequent requests with the+-- appropriate Marker in order to retrieve the next page of results.+--+-- Operations that have an 'AWSPager' instance can transparently perform subsequent+-- requests, correctly setting Markers and other request facets to iterate through+-- the entire result set of a truncated API operation. Operations which support+-- this have an additional note in the documentation.+--+-- Many operations have the ability to filter results on the server side. See the+-- individual operation parameters for details.++-- $waiters+-- Waiters poll by repeatedly sending a request until some remote success condition+-- configured by the 'Wait' specification is fulfilled. The 'Wait' specification+-- determines how many attempts should be made, in addition to delay and retry strategies.

@@ -0,0 +1,481 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.CreateCertificateAuthority+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Creates a root or subordinate private certificate authority (CA). You+-- must specify the CA configuration, an optional configuration for Online+-- Certificate Status Protocol (OCSP) and\/or a certificate revocation list+-- (CRL), the CA type, and an optional idempotency token to avoid+-- accidental creation of multiple CAs. The CA configuration specifies the+-- name of the algorithm and key size to be used to create the CA private+-- key, the type of signing algorithm that the CA uses, and X.500 subject+-- information. The OCSP configuration can optionally specify a custom URL+-- for the OCSP responder. The CRL configuration specifies the CRL+-- expiration period in days (the validity period of the CRL), the Amazon+-- S3 bucket that will contain the CRL, and a CNAME alias for the S3 bucket+-- that is included in certificates issued by the CA. If successful, this+-- action returns the Amazon Resource Name (ARN) of the CA.+--+-- Both Amazon Web Services Private CA and the IAM principal must have+-- permission to write to the S3 bucket that you specify. If the IAM+-- principal making the call does not have permission to write to the+-- bucket, then an exception is thrown. For more information, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#s3-policies Access policies for CRLs in Amazon S3>.+--+-- Amazon Web Services Private CA assets that are stored in Amazon S3 can+-- be protected with encryption. For more information, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/PcaCreateCa.html#crl-encryption Encrypting Your CRLs>.+module Amazonka.CertificateManagerPCA.CreateCertificateAuthority+  ( -- * Creating a Request+    CreateCertificateAuthority (..),+    newCreateCertificateAuthority,++    -- * Request Lenses+    createCertificateAuthority_idempotencyToken,+    createCertificateAuthority_keyStorageSecurityStandard,+    createCertificateAuthority_revocationConfiguration,+    createCertificateAuthority_tags,+    createCertificateAuthority_usageMode,+    createCertificateAuthority_certificateAuthorityConfiguration,+    createCertificateAuthority_certificateAuthorityType,++    -- * Destructuring the Response+    CreateCertificateAuthorityResponse (..),+    newCreateCertificateAuthorityResponse,++    -- * Response Lenses+    createCertificateAuthorityResponse_certificateAuthorityArn,+    createCertificateAuthorityResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newCreateCertificateAuthority' smart constructor.+data CreateCertificateAuthority = CreateCertificateAuthority'+  { -- | Custom string that can be used to distinguish between calls to the+    -- __CreateCertificateAuthority__ action. Idempotency tokens for+    -- __CreateCertificateAuthority__ time out after five minutes. Therefore,+    -- if you call __CreateCertificateAuthority__ multiple times with the same+    -- idempotency token within five minutes, Amazon Web Services Private CA+    -- recognizes that you are requesting only certificate authority and will+    -- issue only one. If you change the idempotency token for each call,+    -- Amazon Web Services Private CA recognizes that you are requesting+    -- multiple certificate authorities.+    idempotencyToken :: Prelude.Maybe Prelude.Text,+    -- | Specifies a cryptographic key management compliance standard used for+    -- handling CA keys.+    --+    -- Default: FIPS_140_2_LEVEL_3_OR_HIGHER+    --+    -- /Note:/ @FIPS_140_2_LEVEL_3_OR_HIGHER@ is not supported in the following+    -- Regions:+    --+    -- -   ap-northeast-3+    --+    -- -   ap-southeast-3+    --+    -- When creating a CA in these Regions, you must provide+    -- @FIPS_140_2_LEVEL_2_OR_HIGHER@ as the argument for+    -- @KeyStorageSecurityStandard@. Failure to do this results in an+    -- @InvalidArgsException@ with the message, \"A certificate authority+    -- cannot be created in this region with the specified security standard.\"+    keyStorageSecurityStandard :: Prelude.Maybe KeyStorageSecurityStandard,+    -- | Contains information to enable Online Certificate Status Protocol (OCSP)+    -- support, to enable a certificate revocation list (CRL), to enable both,+    -- or to enable neither. The default is for both certificate validation+    -- mechanisms to be disabled.+    --+    -- The following requirements apply to revocation configurations.+    --+    -- -   A configuration disabling CRLs or OCSP must contain only the+    --     @Enabled=False@ parameter, and will fail if other parameters such as+    --     @CustomCname@ or @ExpirationInDays@ are included.+    --+    -- -   In a CRL configuration, the @S3BucketName@ parameter must conform to+    --     <https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html Amazon S3 bucket naming rules>.+    --+    -- -   A configuration containing a custom Canonical Name (CNAME) parameter+    --     for CRLs or OCSP must conform to+    --     <https://www.ietf.org/rfc/rfc2396.txt RFC2396> restrictions on the+    --     use of special characters in a CNAME.+    --+    -- -   In a CRL or OCSP configuration, the value of a CNAME parameter must+    --     not include a protocol prefix such as \"http:\/\/\" or+    --     \"https:\/\/\".+    --+    -- For more information, see the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html OcspConfiguration>+    -- and+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html CrlConfiguration>+    -- types.+    revocationConfiguration :: Prelude.Maybe RevocationConfiguration,+    -- | Key-value pairs that will be attached to the new private CA. You can+    -- associate up to 50 tags with a private CA. For information using tags+    -- with IAM to manage permissions, see+    -- <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html Controlling Access Using IAM Tags>.+    tags :: Prelude.Maybe (Prelude.NonEmpty Tag),+    -- | Specifies whether the CA issues general-purpose certificates that+    -- typically require a revocation mechanism, or short-lived certificates+    -- that may optionally omit revocation because they expire quickly.+    -- Short-lived certificate validity is limited to seven days.+    --+    -- The default value is GENERAL_PURPOSE.+    usageMode :: Prelude.Maybe CertificateAuthorityUsageMode,+    -- | Name and bit size of the private key algorithm, the name of the signing+    -- algorithm, and X.500 certificate subject information.+    certificateAuthorityConfiguration :: CertificateAuthorityConfiguration,+    -- | The type of the certificate authority.+    certificateAuthorityType :: CertificateAuthorityType+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreateCertificateAuthority' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'idempotencyToken', 'createCertificateAuthority_idempotencyToken' - Custom string that can be used to distinguish between calls to the+-- __CreateCertificateAuthority__ action. Idempotency tokens for+-- __CreateCertificateAuthority__ time out after five minutes. Therefore,+-- if you call __CreateCertificateAuthority__ multiple times with the same+-- idempotency token within five minutes, Amazon Web Services Private CA+-- recognizes that you are requesting only certificate authority and will+-- issue only one. If you change the idempotency token for each call,+-- Amazon Web Services Private CA recognizes that you are requesting+-- multiple certificate authorities.+--+-- 'keyStorageSecurityStandard', 'createCertificateAuthority_keyStorageSecurityStandard' - Specifies a cryptographic key management compliance standard used for+-- handling CA keys.+--+-- Default: FIPS_140_2_LEVEL_3_OR_HIGHER+--+-- /Note:/ @FIPS_140_2_LEVEL_3_OR_HIGHER@ is not supported in the following+-- Regions:+--+-- -   ap-northeast-3+--+-- -   ap-southeast-3+--+-- When creating a CA in these Regions, you must provide+-- @FIPS_140_2_LEVEL_2_OR_HIGHER@ as the argument for+-- @KeyStorageSecurityStandard@. Failure to do this results in an+-- @InvalidArgsException@ with the message, \"A certificate authority+-- cannot be created in this region with the specified security standard.\"+--+-- 'revocationConfiguration', 'createCertificateAuthority_revocationConfiguration' - Contains information to enable Online Certificate Status Protocol (OCSP)+-- support, to enable a certificate revocation list (CRL), to enable both,+-- or to enable neither. The default is for both certificate validation+-- mechanisms to be disabled.+--+-- The following requirements apply to revocation configurations.+--+-- -   A configuration disabling CRLs or OCSP must contain only the+--     @Enabled=False@ parameter, and will fail if other parameters such as+--     @CustomCname@ or @ExpirationInDays@ are included.+--+-- -   In a CRL configuration, the @S3BucketName@ parameter must conform to+--     <https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html Amazon S3 bucket naming rules>.+--+-- -   A configuration containing a custom Canonical Name (CNAME) parameter+--     for CRLs or OCSP must conform to+--     <https://www.ietf.org/rfc/rfc2396.txt RFC2396> restrictions on the+--     use of special characters in a CNAME.+--+-- -   In a CRL or OCSP configuration, the value of a CNAME parameter must+--     not include a protocol prefix such as \"http:\/\/\" or+--     \"https:\/\/\".+--+-- For more information, see the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html OcspConfiguration>+-- and+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html CrlConfiguration>+-- types.+--+-- 'tags', 'createCertificateAuthority_tags' - Key-value pairs that will be attached to the new private CA. You can+-- associate up to 50 tags with a private CA. For information using tags+-- with IAM to manage permissions, see+-- <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html Controlling Access Using IAM Tags>.+--+-- 'usageMode', 'createCertificateAuthority_usageMode' - Specifies whether the CA issues general-purpose certificates that+-- typically require a revocation mechanism, or short-lived certificates+-- that may optionally omit revocation because they expire quickly.+-- Short-lived certificate validity is limited to seven days.+--+-- The default value is GENERAL_PURPOSE.+--+-- 'certificateAuthorityConfiguration', 'createCertificateAuthority_certificateAuthorityConfiguration' - Name and bit size of the private key algorithm, the name of the signing+-- algorithm, and X.500 certificate subject information.+--+-- 'certificateAuthorityType', 'createCertificateAuthority_certificateAuthorityType' - The type of the certificate authority.+newCreateCertificateAuthority ::+  -- | 'certificateAuthorityConfiguration'+  CertificateAuthorityConfiguration ->+  -- | 'certificateAuthorityType'+  CertificateAuthorityType ->+  CreateCertificateAuthority+newCreateCertificateAuthority+  pCertificateAuthorityConfiguration_+  pCertificateAuthorityType_ =+    CreateCertificateAuthority'+      { idempotencyToken =+          Prelude.Nothing,+        keyStorageSecurityStandard = Prelude.Nothing,+        revocationConfiguration = Prelude.Nothing,+        tags = Prelude.Nothing,+        usageMode = Prelude.Nothing,+        certificateAuthorityConfiguration =+          pCertificateAuthorityConfiguration_,+        certificateAuthorityType =+          pCertificateAuthorityType_+      }++-- | Custom string that can be used to distinguish between calls to the+-- __CreateCertificateAuthority__ action. Idempotency tokens for+-- __CreateCertificateAuthority__ time out after five minutes. Therefore,+-- if you call __CreateCertificateAuthority__ multiple times with the same+-- idempotency token within five minutes, Amazon Web Services Private CA+-- recognizes that you are requesting only certificate authority and will+-- issue only one. If you change the idempotency token for each call,+-- Amazon Web Services Private CA recognizes that you are requesting+-- multiple certificate authorities.+createCertificateAuthority_idempotencyToken :: Lens.Lens' CreateCertificateAuthority (Prelude.Maybe Prelude.Text)+createCertificateAuthority_idempotencyToken = Lens.lens (\CreateCertificateAuthority' {idempotencyToken} -> idempotencyToken) (\s@CreateCertificateAuthority' {} a -> s {idempotencyToken = a} :: CreateCertificateAuthority)++-- | Specifies a cryptographic key management compliance standard used for+-- handling CA keys.+--+-- Default: FIPS_140_2_LEVEL_3_OR_HIGHER+--+-- /Note:/ @FIPS_140_2_LEVEL_3_OR_HIGHER@ is not supported in the following+-- Regions:+--+-- -   ap-northeast-3+--+-- -   ap-southeast-3+--+-- When creating a CA in these Regions, you must provide+-- @FIPS_140_2_LEVEL_2_OR_HIGHER@ as the argument for+-- @KeyStorageSecurityStandard@. Failure to do this results in an+-- @InvalidArgsException@ with the message, \"A certificate authority+-- cannot be created in this region with the specified security standard.\"+createCertificateAuthority_keyStorageSecurityStandard :: Lens.Lens' CreateCertificateAuthority (Prelude.Maybe KeyStorageSecurityStandard)+createCertificateAuthority_keyStorageSecurityStandard = Lens.lens (\CreateCertificateAuthority' {keyStorageSecurityStandard} -> keyStorageSecurityStandard) (\s@CreateCertificateAuthority' {} a -> s {keyStorageSecurityStandard = a} :: CreateCertificateAuthority)++-- | Contains information to enable Online Certificate Status Protocol (OCSP)+-- support, to enable a certificate revocation list (CRL), to enable both,+-- or to enable neither. The default is for both certificate validation+-- mechanisms to be disabled.+--+-- The following requirements apply to revocation configurations.+--+-- -   A configuration disabling CRLs or OCSP must contain only the+--     @Enabled=False@ parameter, and will fail if other parameters such as+--     @CustomCname@ or @ExpirationInDays@ are included.+--+-- -   In a CRL configuration, the @S3BucketName@ parameter must conform to+--     <https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html Amazon S3 bucket naming rules>.+--+-- -   A configuration containing a custom Canonical Name (CNAME) parameter+--     for CRLs or OCSP must conform to+--     <https://www.ietf.org/rfc/rfc2396.txt RFC2396> restrictions on the+--     use of special characters in a CNAME.+--+-- -   In a CRL or OCSP configuration, the value of a CNAME parameter must+--     not include a protocol prefix such as \"http:\/\/\" or+--     \"https:\/\/\".+--+-- For more information, see the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html OcspConfiguration>+-- and+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html CrlConfiguration>+-- types.+createCertificateAuthority_revocationConfiguration :: Lens.Lens' CreateCertificateAuthority (Prelude.Maybe RevocationConfiguration)+createCertificateAuthority_revocationConfiguration = Lens.lens (\CreateCertificateAuthority' {revocationConfiguration} -> revocationConfiguration) (\s@CreateCertificateAuthority' {} a -> s {revocationConfiguration = a} :: CreateCertificateAuthority)++-- | Key-value pairs that will be attached to the new private CA. You can+-- associate up to 50 tags with a private CA. For information using tags+-- with IAM to manage permissions, see+-- <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html Controlling Access Using IAM Tags>.+createCertificateAuthority_tags :: Lens.Lens' CreateCertificateAuthority (Prelude.Maybe (Prelude.NonEmpty Tag))+createCertificateAuthority_tags = Lens.lens (\CreateCertificateAuthority' {tags} -> tags) (\s@CreateCertificateAuthority' {} a -> s {tags = a} :: CreateCertificateAuthority) Prelude.. Lens.mapping Lens.coerced++-- | Specifies whether the CA issues general-purpose certificates that+-- typically require a revocation mechanism, or short-lived certificates+-- that may optionally omit revocation because they expire quickly.+-- Short-lived certificate validity is limited to seven days.+--+-- The default value is GENERAL_PURPOSE.+createCertificateAuthority_usageMode :: Lens.Lens' CreateCertificateAuthority (Prelude.Maybe CertificateAuthorityUsageMode)+createCertificateAuthority_usageMode = Lens.lens (\CreateCertificateAuthority' {usageMode} -> usageMode) (\s@CreateCertificateAuthority' {} a -> s {usageMode = a} :: CreateCertificateAuthority)++-- | Name and bit size of the private key algorithm, the name of the signing+-- algorithm, and X.500 certificate subject information.+createCertificateAuthority_certificateAuthorityConfiguration :: Lens.Lens' CreateCertificateAuthority CertificateAuthorityConfiguration+createCertificateAuthority_certificateAuthorityConfiguration = Lens.lens (\CreateCertificateAuthority' {certificateAuthorityConfiguration} -> certificateAuthorityConfiguration) (\s@CreateCertificateAuthority' {} a -> s {certificateAuthorityConfiguration = a} :: CreateCertificateAuthority)++-- | The type of the certificate authority.+createCertificateAuthority_certificateAuthorityType :: Lens.Lens' CreateCertificateAuthority CertificateAuthorityType+createCertificateAuthority_certificateAuthorityType = Lens.lens (\CreateCertificateAuthority' {certificateAuthorityType} -> certificateAuthorityType) (\s@CreateCertificateAuthority' {} a -> s {certificateAuthorityType = a} :: CreateCertificateAuthority)++instance Core.AWSRequest CreateCertificateAuthority where+  type+    AWSResponse CreateCertificateAuthority =+      CreateCertificateAuthorityResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          CreateCertificateAuthorityResponse'+            Prelude.<$> (x Data..?> "CertificateAuthorityArn")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance Prelude.Hashable CreateCertificateAuthority where+  hashWithSalt _salt CreateCertificateAuthority' {..} =+    _salt+      `Prelude.hashWithSalt` idempotencyToken+      `Prelude.hashWithSalt` keyStorageSecurityStandard+      `Prelude.hashWithSalt` revocationConfiguration+      `Prelude.hashWithSalt` tags+      `Prelude.hashWithSalt` usageMode+      `Prelude.hashWithSalt` certificateAuthorityConfiguration+      `Prelude.hashWithSalt` certificateAuthorityType++instance Prelude.NFData CreateCertificateAuthority where+  rnf CreateCertificateAuthority' {..} =+    Prelude.rnf idempotencyToken+      `Prelude.seq` Prelude.rnf keyStorageSecurityStandard+      `Prelude.seq` Prelude.rnf revocationConfiguration+      `Prelude.seq` Prelude.rnf tags+      `Prelude.seq` Prelude.rnf usageMode+      `Prelude.seq` Prelude.rnf certificateAuthorityConfiguration+      `Prelude.seq` Prelude.rnf certificateAuthorityType++instance Data.ToHeaders CreateCertificateAuthority where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.CreateCertificateAuthority" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON CreateCertificateAuthority where+  toJSON CreateCertificateAuthority' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("IdempotencyToken" Data..=)+              Prelude.<$> idempotencyToken,+            ("KeyStorageSecurityStandard" Data..=)+              Prelude.<$> keyStorageSecurityStandard,+            ("RevocationConfiguration" Data..=)+              Prelude.<$> revocationConfiguration,+            ("Tags" Data..=) Prelude.<$> tags,+            ("UsageMode" Data..=) Prelude.<$> usageMode,+            Prelude.Just+              ( "CertificateAuthorityConfiguration"+                  Data..= certificateAuthorityConfiguration+              ),+            Prelude.Just+              ( "CertificateAuthorityType"+                  Data..= certificateAuthorityType+              )+          ]+      )++instance Data.ToPath CreateCertificateAuthority where+  toPath = Prelude.const "/"++instance Data.ToQuery CreateCertificateAuthority where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newCreateCertificateAuthorityResponse' smart constructor.+data CreateCertificateAuthorityResponse = CreateCertificateAuthorityResponse'+  { -- | If successful, the Amazon Resource Name (ARN) of the certificate+    -- authority (CA). This is of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreateCertificateAuthorityResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'createCertificateAuthorityResponse_certificateAuthorityArn' - If successful, the Amazon Resource Name (ARN) of the certificate+-- authority (CA). This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 'httpStatus', 'createCertificateAuthorityResponse_httpStatus' - The response's http status code.+newCreateCertificateAuthorityResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  CreateCertificateAuthorityResponse+newCreateCertificateAuthorityResponse pHttpStatus_ =+  CreateCertificateAuthorityResponse'+    { certificateAuthorityArn =+        Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | If successful, the Amazon Resource Name (ARN) of the certificate+-- authority (CA). This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+createCertificateAuthorityResponse_certificateAuthorityArn :: Lens.Lens' CreateCertificateAuthorityResponse (Prelude.Maybe Prelude.Text)+createCertificateAuthorityResponse_certificateAuthorityArn = Lens.lens (\CreateCertificateAuthorityResponse' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@CreateCertificateAuthorityResponse' {} a -> s {certificateAuthorityArn = a} :: CreateCertificateAuthorityResponse)++-- | The response's http status code.+createCertificateAuthorityResponse_httpStatus :: Lens.Lens' CreateCertificateAuthorityResponse Prelude.Int+createCertificateAuthorityResponse_httpStatus = Lens.lens (\CreateCertificateAuthorityResponse' {httpStatus} -> httpStatus) (\s@CreateCertificateAuthorityResponse' {} a -> s {httpStatus = a} :: CreateCertificateAuthorityResponse)++instance+  Prelude.NFData+    CreateCertificateAuthorityResponse+  where+  rnf CreateCertificateAuthorityResponse' {..} =+    Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,285 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.CreateCertificateAuthorityAuditReport+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Creates an audit report that lists every time that your CA private key+-- is used. The report is saved in the Amazon S3 bucket that you specify on+-- input. The+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html IssueCertificate>+-- and+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html RevokeCertificate>+-- actions use the private key.+--+-- Both Amazon Web Services Private CA and the IAM principal must have+-- permission to write to the S3 bucket that you specify. If the IAM+-- principal making the call does not have permission to write to the+-- bucket, then an exception is thrown. For more information, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#s3-policies Access policies for CRLs in Amazon S3>.+--+-- Amazon Web Services Private CA assets that are stored in Amazon S3 can+-- be protected with encryption. For more information, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/PcaAuditReport.html#audit-report-encryption Encrypting Your Audit Reports>.+--+-- You can generate a maximum of one report every 30 minutes.+module Amazonka.CertificateManagerPCA.CreateCertificateAuthorityAuditReport+  ( -- * Creating a Request+    CreateCertificateAuthorityAuditReport (..),+    newCreateCertificateAuthorityAuditReport,++    -- * Request Lenses+    createCertificateAuthorityAuditReport_certificateAuthorityArn,+    createCertificateAuthorityAuditReport_s3BucketName,+    createCertificateAuthorityAuditReport_auditReportResponseFormat,++    -- * Destructuring the Response+    CreateCertificateAuthorityAuditReportResponse (..),+    newCreateCertificateAuthorityAuditReportResponse,++    -- * Response Lenses+    createCertificateAuthorityAuditReportResponse_auditReportId,+    createCertificateAuthorityAuditReportResponse_s3Key,+    createCertificateAuthorityAuditReportResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newCreateCertificateAuthorityAuditReport' smart constructor.+data CreateCertificateAuthorityAuditReport = CreateCertificateAuthorityAuditReport'+  { -- | The Amazon Resource Name (ARN) of the CA to be audited. This is of the+    -- form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text,+    -- | The name of the S3 bucket that will contain the audit report.+    s3BucketName :: Prelude.Text,+    -- | The format in which to create the report. This can be either __JSON__ or+    -- __CSV__.+    auditReportResponseFormat :: AuditReportResponseFormat+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreateCertificateAuthorityAuditReport' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'createCertificateAuthorityAuditReport_certificateAuthorityArn' - The Amazon Resource Name (ARN) of the CA to be audited. This is of the+-- form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 's3BucketName', 'createCertificateAuthorityAuditReport_s3BucketName' - The name of the S3 bucket that will contain the audit report.+--+-- 'auditReportResponseFormat', 'createCertificateAuthorityAuditReport_auditReportResponseFormat' - The format in which to create the report. This can be either __JSON__ or+-- __CSV__.+newCreateCertificateAuthorityAuditReport ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 's3BucketName'+  Prelude.Text ->+  -- | 'auditReportResponseFormat'+  AuditReportResponseFormat ->+  CreateCertificateAuthorityAuditReport+newCreateCertificateAuthorityAuditReport+  pCertificateAuthorityArn_+  pS3BucketName_+  pAuditReportResponseFormat_ =+    CreateCertificateAuthorityAuditReport'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_,+        s3BucketName = pS3BucketName_,+        auditReportResponseFormat =+          pAuditReportResponseFormat_+      }++-- | The Amazon Resource Name (ARN) of the CA to be audited. This is of the+-- form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+createCertificateAuthorityAuditReport_certificateAuthorityArn :: Lens.Lens' CreateCertificateAuthorityAuditReport Prelude.Text+createCertificateAuthorityAuditReport_certificateAuthorityArn = Lens.lens (\CreateCertificateAuthorityAuditReport' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@CreateCertificateAuthorityAuditReport' {} a -> s {certificateAuthorityArn = a} :: CreateCertificateAuthorityAuditReport)++-- | The name of the S3 bucket that will contain the audit report.+createCertificateAuthorityAuditReport_s3BucketName :: Lens.Lens' CreateCertificateAuthorityAuditReport Prelude.Text+createCertificateAuthorityAuditReport_s3BucketName = Lens.lens (\CreateCertificateAuthorityAuditReport' {s3BucketName} -> s3BucketName) (\s@CreateCertificateAuthorityAuditReport' {} a -> s {s3BucketName = a} :: CreateCertificateAuthorityAuditReport)++-- | The format in which to create the report. This can be either __JSON__ or+-- __CSV__.+createCertificateAuthorityAuditReport_auditReportResponseFormat :: Lens.Lens' CreateCertificateAuthorityAuditReport AuditReportResponseFormat+createCertificateAuthorityAuditReport_auditReportResponseFormat = Lens.lens (\CreateCertificateAuthorityAuditReport' {auditReportResponseFormat} -> auditReportResponseFormat) (\s@CreateCertificateAuthorityAuditReport' {} a -> s {auditReportResponseFormat = a} :: CreateCertificateAuthorityAuditReport)++instance+  Core.AWSRequest+    CreateCertificateAuthorityAuditReport+  where+  type+    AWSResponse+      CreateCertificateAuthorityAuditReport =+      CreateCertificateAuthorityAuditReportResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          CreateCertificateAuthorityAuditReportResponse'+            Prelude.<$> (x Data..?> "AuditReportId")+            Prelude.<*> (x Data..?> "S3Key")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance+  Prelude.Hashable+    CreateCertificateAuthorityAuditReport+  where+  hashWithSalt+    _salt+    CreateCertificateAuthorityAuditReport' {..} =+      _salt+        `Prelude.hashWithSalt` certificateAuthorityArn+        `Prelude.hashWithSalt` s3BucketName+        `Prelude.hashWithSalt` auditReportResponseFormat++instance+  Prelude.NFData+    CreateCertificateAuthorityAuditReport+  where+  rnf CreateCertificateAuthorityAuditReport' {..} =+    Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf s3BucketName+      `Prelude.seq` Prelude.rnf auditReportResponseFormat++instance+  Data.ToHeaders+    CreateCertificateAuthorityAuditReport+  where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.CreateCertificateAuthorityAuditReport" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance+  Data.ToJSON+    CreateCertificateAuthorityAuditReport+  where+  toJSON CreateCertificateAuthorityAuditReport' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just ("S3BucketName" Data..= s3BucketName),+            Prelude.Just+              ( "AuditReportResponseFormat"+                  Data..= auditReportResponseFormat+              )+          ]+      )++instance+  Data.ToPath+    CreateCertificateAuthorityAuditReport+  where+  toPath = Prelude.const "/"++instance+  Data.ToQuery+    CreateCertificateAuthorityAuditReport+  where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newCreateCertificateAuthorityAuditReportResponse' smart constructor.+data CreateCertificateAuthorityAuditReportResponse = CreateCertificateAuthorityAuditReportResponse'+  { -- | An alphanumeric string that contains a report identifier.+    auditReportId :: Prelude.Maybe Prelude.Text,+    -- | The __key__ that uniquely identifies the report file in your S3 bucket.+    s3Key :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreateCertificateAuthorityAuditReportResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'auditReportId', 'createCertificateAuthorityAuditReportResponse_auditReportId' - An alphanumeric string that contains a report identifier.+--+-- 's3Key', 'createCertificateAuthorityAuditReportResponse_s3Key' - The __key__ that uniquely identifies the report file in your S3 bucket.+--+-- 'httpStatus', 'createCertificateAuthorityAuditReportResponse_httpStatus' - The response's http status code.+newCreateCertificateAuthorityAuditReportResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  CreateCertificateAuthorityAuditReportResponse+newCreateCertificateAuthorityAuditReportResponse+  pHttpStatus_ =+    CreateCertificateAuthorityAuditReportResponse'+      { auditReportId =+          Prelude.Nothing,+        s3Key = Prelude.Nothing,+        httpStatus = pHttpStatus_+      }++-- | An alphanumeric string that contains a report identifier.+createCertificateAuthorityAuditReportResponse_auditReportId :: Lens.Lens' CreateCertificateAuthorityAuditReportResponse (Prelude.Maybe Prelude.Text)+createCertificateAuthorityAuditReportResponse_auditReportId = Lens.lens (\CreateCertificateAuthorityAuditReportResponse' {auditReportId} -> auditReportId) (\s@CreateCertificateAuthorityAuditReportResponse' {} a -> s {auditReportId = a} :: CreateCertificateAuthorityAuditReportResponse)++-- | The __key__ that uniquely identifies the report file in your S3 bucket.+createCertificateAuthorityAuditReportResponse_s3Key :: Lens.Lens' CreateCertificateAuthorityAuditReportResponse (Prelude.Maybe Prelude.Text)+createCertificateAuthorityAuditReportResponse_s3Key = Lens.lens (\CreateCertificateAuthorityAuditReportResponse' {s3Key} -> s3Key) (\s@CreateCertificateAuthorityAuditReportResponse' {} a -> s {s3Key = a} :: CreateCertificateAuthorityAuditReportResponse)++-- | The response's http status code.+createCertificateAuthorityAuditReportResponse_httpStatus :: Lens.Lens' CreateCertificateAuthorityAuditReportResponse Prelude.Int+createCertificateAuthorityAuditReportResponse_httpStatus = Lens.lens (\CreateCertificateAuthorityAuditReportResponse' {httpStatus} -> httpStatus) (\s@CreateCertificateAuthorityAuditReportResponse' {} a -> s {httpStatus = a} :: CreateCertificateAuthorityAuditReportResponse)++instance+  Prelude.NFData+    CreateCertificateAuthorityAuditReportResponse+  where+  rnf+    CreateCertificateAuthorityAuditReportResponse' {..} =+      Prelude.rnf auditReportId+        `Prelude.seq` Prelude.rnf s3Key+        `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,240 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.CreatePermission+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Grants one or more permissions on a private CA to the Certificate+-- Manager (ACM) service principal (@acm.amazonaws.com@). These permissions+-- allow ACM to issue and renew ACM certificates that reside in the same+-- Amazon Web Services account as the CA.+--+-- You can list current permissions with the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html ListPermissions>+-- action and revoke them with the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html DeletePermission>+-- action.+--+-- __About Permissions__+--+-- -   If the private CA and the certificates it issues reside in the same+--     account, you can use @CreatePermission@ to grant permissions for ACM+--     to carry out automatic certificate renewals.+--+-- -   For automatic certificate renewal to succeed, the ACM service+--     principal needs permissions to create, retrieve, and list+--     certificates.+--+-- -   If the private CA and the ACM certificates reside in different+--     accounts, then permissions cannot be used to enable automatic+--     renewals. Instead, the ACM certificate owner must set up a+--     resource-based policy to enable cross-account issuance and renewals.+--     For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html Using a Resource Based Policy with Amazon Web Services Private CA>.+module Amazonka.CertificateManagerPCA.CreatePermission+  ( -- * Creating a Request+    CreatePermission (..),+    newCreatePermission,++    -- * Request Lenses+    createPermission_sourceAccount,+    createPermission_certificateAuthorityArn,+    createPermission_principal,+    createPermission_actions,++    -- * Destructuring the Response+    CreatePermissionResponse (..),+    newCreatePermissionResponse,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newCreatePermission' smart constructor.+data CreatePermission = CreatePermission'+  { -- | The ID of the calling account.+    sourceAccount :: Prelude.Maybe Prelude.Text,+    -- | The Amazon Resource Name (ARN) of the CA that grants the permissions.+    -- You can find the ARN by calling the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+    -- action. This must have the following form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text,+    -- | The Amazon Web Services service or identity that receives the+    -- permission. At this time, the only valid principal is+    -- @acm.amazonaws.com@.+    principal :: Prelude.Text,+    -- | The actions that the specified Amazon Web Services service principal can+    -- use. These include @IssueCertificate@, @GetCertificate@, and+    -- @ListPermissions@.+    actions :: Prelude.NonEmpty ActionType+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreatePermission' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'sourceAccount', 'createPermission_sourceAccount' - The ID of the calling account.+--+-- 'certificateAuthorityArn', 'createPermission_certificateAuthorityArn' - The Amazon Resource Name (ARN) of the CA that grants the permissions.+-- You can find the ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 'principal', 'createPermission_principal' - The Amazon Web Services service or identity that receives the+-- permission. At this time, the only valid principal is+-- @acm.amazonaws.com@.+--+-- 'actions', 'createPermission_actions' - The actions that the specified Amazon Web Services service principal can+-- use. These include @IssueCertificate@, @GetCertificate@, and+-- @ListPermissions@.+newCreatePermission ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'principal'+  Prelude.Text ->+  -- | 'actions'+  Prelude.NonEmpty ActionType ->+  CreatePermission+newCreatePermission+  pCertificateAuthorityArn_+  pPrincipal_+  pActions_ =+    CreatePermission'+      { sourceAccount = Prelude.Nothing,+        certificateAuthorityArn = pCertificateAuthorityArn_,+        principal = pPrincipal_,+        actions = Lens.coerced Lens.# pActions_+      }++-- | The ID of the calling account.+createPermission_sourceAccount :: Lens.Lens' CreatePermission (Prelude.Maybe Prelude.Text)+createPermission_sourceAccount = Lens.lens (\CreatePermission' {sourceAccount} -> sourceAccount) (\s@CreatePermission' {} a -> s {sourceAccount = a} :: CreatePermission)++-- | The Amazon Resource Name (ARN) of the CA that grants the permissions.+-- You can find the ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+createPermission_certificateAuthorityArn :: Lens.Lens' CreatePermission Prelude.Text+createPermission_certificateAuthorityArn = Lens.lens (\CreatePermission' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@CreatePermission' {} a -> s {certificateAuthorityArn = a} :: CreatePermission)++-- | The Amazon Web Services service or identity that receives the+-- permission. At this time, the only valid principal is+-- @acm.amazonaws.com@.+createPermission_principal :: Lens.Lens' CreatePermission Prelude.Text+createPermission_principal = Lens.lens (\CreatePermission' {principal} -> principal) (\s@CreatePermission' {} a -> s {principal = a} :: CreatePermission)++-- | The actions that the specified Amazon Web Services service principal can+-- use. These include @IssueCertificate@, @GetCertificate@, and+-- @ListPermissions@.+createPermission_actions :: Lens.Lens' CreatePermission (Prelude.NonEmpty ActionType)+createPermission_actions = Lens.lens (\CreatePermission' {actions} -> actions) (\s@CreatePermission' {} a -> s {actions = a} :: CreatePermission) Prelude.. Lens.coerced++instance Core.AWSRequest CreatePermission where+  type+    AWSResponse CreatePermission =+      CreatePermissionResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveNull CreatePermissionResponse'++instance Prelude.Hashable CreatePermission where+  hashWithSalt _salt CreatePermission' {..} =+    _salt+      `Prelude.hashWithSalt` sourceAccount+      `Prelude.hashWithSalt` certificateAuthorityArn+      `Prelude.hashWithSalt` principal+      `Prelude.hashWithSalt` actions++instance Prelude.NFData CreatePermission where+  rnf CreatePermission' {..} =+    Prelude.rnf sourceAccount+      `Prelude.seq` Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf principal+      `Prelude.seq` Prelude.rnf actions++instance Data.ToHeaders CreatePermission where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.CreatePermission" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON CreatePermission where+  toJSON CreatePermission' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("SourceAccount" Data..=) Prelude.<$> sourceAccount,+            Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just ("Principal" Data..= principal),+            Prelude.Just ("Actions" Data..= actions)+          ]+      )++instance Data.ToPath CreatePermission where+  toPath = Prelude.const "/"++instance Data.ToQuery CreatePermission where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newCreatePermissionResponse' smart constructor.+data CreatePermissionResponse = CreatePermissionResponse'+  {+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'CreatePermissionResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+newCreatePermissionResponse ::+  CreatePermissionResponse+newCreatePermissionResponse =+  CreatePermissionResponse'++instance Prelude.NFData CreatePermissionResponse where+  rnf _ = ()

@@ -0,0 +1,209 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.DeleteCertificateAuthority+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Deletes a private certificate authority (CA). You must provide the+-- Amazon Resource Name (ARN) of the private CA that you want to delete.+-- You can find the ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action.+--+-- Deleting a CA will invalidate other CAs and certificates below it in+-- your CA hierarchy.+--+-- Before you can delete a CA that you have created and activated, you must+-- disable it. To do this, call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html UpdateCertificateAuthority>+-- action and set the __CertificateAuthorityStatus__ parameter to+-- @DISABLED@.+--+-- Additionally, you can delete a CA if you are waiting for it to be+-- created (that is, the status of the CA is @CREATING@). You can also+-- delete it if the CA has been created but you haven\'t yet imported the+-- signed certificate into Amazon Web Services Private CA (that is, the+-- status of the CA is @PENDING_CERTIFICATE@).+--+-- When you successfully call+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeleteCertificateAuthority.html DeleteCertificateAuthority>,+-- the CA\'s status changes to @DELETED@. However, the CA won\'t be+-- permanently deleted until the restoration period has passed. By default,+-- if you do not set the @PermanentDeletionTimeInDays@ parameter, the CA+-- remains restorable for 30 days. You can set the parameter from 7 to 30+-- days. The+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_DescribeCertificateAuthority.html DescribeCertificateAuthority>+-- action returns the time remaining in the restoration window of a private+-- CA in the @DELETED@ state. To restore an eligible CA, call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_RestoreCertificateAuthority.html RestoreCertificateAuthority>+-- action.+module Amazonka.CertificateManagerPCA.DeleteCertificateAuthority+  ( -- * Creating a Request+    DeleteCertificateAuthority (..),+    newDeleteCertificateAuthority,++    -- * Request Lenses+    deleteCertificateAuthority_permanentDeletionTimeInDays,+    deleteCertificateAuthority_certificateAuthorityArn,++    -- * Destructuring the Response+    DeleteCertificateAuthorityResponse (..),+    newDeleteCertificateAuthorityResponse,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newDeleteCertificateAuthority' smart constructor.+data DeleteCertificateAuthority = DeleteCertificateAuthority'+  { -- | The number of days to make a CA restorable after it has been deleted.+    -- This can be anywhere from 7 to 30 days, with 30 being the default.+    permanentDeletionTimeInDays :: Prelude.Maybe Prelude.Natural,+    -- | The Amazon Resource Name (ARN) that was returned when you called+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+    -- This must have the following form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeleteCertificateAuthority' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'permanentDeletionTimeInDays', 'deleteCertificateAuthority_permanentDeletionTimeInDays' - The number of days to make a CA restorable after it has been deleted.+-- This can be anywhere from 7 to 30 days, with 30 being the default.+--+-- 'certificateAuthorityArn', 'deleteCertificateAuthority_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+newDeleteCertificateAuthority ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  DeleteCertificateAuthority+newDeleteCertificateAuthority+  pCertificateAuthorityArn_ =+    DeleteCertificateAuthority'+      { permanentDeletionTimeInDays =+          Prelude.Nothing,+        certificateAuthorityArn =+          pCertificateAuthorityArn_+      }++-- | The number of days to make a CA restorable after it has been deleted.+-- This can be anywhere from 7 to 30 days, with 30 being the default.+deleteCertificateAuthority_permanentDeletionTimeInDays :: Lens.Lens' DeleteCertificateAuthority (Prelude.Maybe Prelude.Natural)+deleteCertificateAuthority_permanentDeletionTimeInDays = Lens.lens (\DeleteCertificateAuthority' {permanentDeletionTimeInDays} -> permanentDeletionTimeInDays) (\s@DeleteCertificateAuthority' {} a -> s {permanentDeletionTimeInDays = a} :: DeleteCertificateAuthority)++-- | The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+deleteCertificateAuthority_certificateAuthorityArn :: Lens.Lens' DeleteCertificateAuthority Prelude.Text+deleteCertificateAuthority_certificateAuthorityArn = Lens.lens (\DeleteCertificateAuthority' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@DeleteCertificateAuthority' {} a -> s {certificateAuthorityArn = a} :: DeleteCertificateAuthority)++instance Core.AWSRequest DeleteCertificateAuthority where+  type+    AWSResponse DeleteCertificateAuthority =+      DeleteCertificateAuthorityResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveNull+      DeleteCertificateAuthorityResponse'++instance Prelude.Hashable DeleteCertificateAuthority where+  hashWithSalt _salt DeleteCertificateAuthority' {..} =+    _salt+      `Prelude.hashWithSalt` permanentDeletionTimeInDays+      `Prelude.hashWithSalt` certificateAuthorityArn++instance Prelude.NFData DeleteCertificateAuthority where+  rnf DeleteCertificateAuthority' {..} =+    Prelude.rnf permanentDeletionTimeInDays+      `Prelude.seq` Prelude.rnf certificateAuthorityArn++instance Data.ToHeaders DeleteCertificateAuthority where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.DeleteCertificateAuthority" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON DeleteCertificateAuthority where+  toJSON DeleteCertificateAuthority' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("PermanentDeletionTimeInDays" Data..=)+              Prelude.<$> permanentDeletionTimeInDays,+            Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              )+          ]+      )++instance Data.ToPath DeleteCertificateAuthority where+  toPath = Prelude.const "/"++instance Data.ToQuery DeleteCertificateAuthority where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newDeleteCertificateAuthorityResponse' smart constructor.+data DeleteCertificateAuthorityResponse = DeleteCertificateAuthorityResponse'+  {+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeleteCertificateAuthorityResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+newDeleteCertificateAuthorityResponse ::+  DeleteCertificateAuthorityResponse+newDeleteCertificateAuthorityResponse =+  DeleteCertificateAuthorityResponse'++instance+  Prelude.NFData+    DeleteCertificateAuthorityResponse+  where+  rnf _ = ()

@@ -0,0 +1,221 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.DeletePermission+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Revokes permissions on a private CA granted to the Certificate Manager+-- (ACM) service principal (acm.amazonaws.com).+--+-- These permissions allow ACM to issue and renew ACM certificates that+-- reside in the same Amazon Web Services account as the CA. If you revoke+-- these permissions, ACM will no longer renew the affected certificates+-- automatically.+--+-- Permissions can be granted with the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreatePermission.html CreatePermission>+-- action and listed with the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html ListPermissions>+-- action.+--+-- __About Permissions__+--+-- -   If the private CA and the certificates it issues reside in the same+--     account, you can use @CreatePermission@ to grant permissions for ACM+--     to carry out automatic certificate renewals.+--+-- -   For automatic certificate renewal to succeed, the ACM service+--     principal needs permissions to create, retrieve, and list+--     certificates.+--+-- -   If the private CA and the ACM certificates reside in different+--     accounts, then permissions cannot be used to enable automatic+--     renewals. Instead, the ACM certificate owner must set up a+--     resource-based policy to enable cross-account issuance and renewals.+--     For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html Using a Resource Based Policy with Amazon Web Services Private CA>.+module Amazonka.CertificateManagerPCA.DeletePermission+  ( -- * Creating a Request+    DeletePermission (..),+    newDeletePermission,++    -- * Request Lenses+    deletePermission_sourceAccount,+    deletePermission_certificateAuthorityArn,+    deletePermission_principal,++    -- * Destructuring the Response+    DeletePermissionResponse (..),+    newDeletePermissionResponse,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newDeletePermission' smart constructor.+data DeletePermission = DeletePermission'+  { -- | The Amazon Web Services account that calls this action.+    sourceAccount :: Prelude.Maybe Prelude.Text,+    -- | The Amazon Resource Number (ARN) of the private CA that issued the+    -- permissions. You can find the CA\'s ARN by calling the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+    -- action. This must have the following form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text,+    -- | The Amazon Web Services service or identity that will have its CA+    -- permissions revoked. At this time, the only valid service principal is+    -- @acm.amazonaws.com@+    principal :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeletePermission' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'sourceAccount', 'deletePermission_sourceAccount' - The Amazon Web Services account that calls this action.+--+-- 'certificateAuthorityArn', 'deletePermission_certificateAuthorityArn' - The Amazon Resource Number (ARN) of the private CA that issued the+-- permissions. You can find the CA\'s ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 'principal', 'deletePermission_principal' - The Amazon Web Services service or identity that will have its CA+-- permissions revoked. At this time, the only valid service principal is+-- @acm.amazonaws.com@+newDeletePermission ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'principal'+  Prelude.Text ->+  DeletePermission+newDeletePermission+  pCertificateAuthorityArn_+  pPrincipal_ =+    DeletePermission'+      { sourceAccount = Prelude.Nothing,+        certificateAuthorityArn = pCertificateAuthorityArn_,+        principal = pPrincipal_+      }++-- | The Amazon Web Services account that calls this action.+deletePermission_sourceAccount :: Lens.Lens' DeletePermission (Prelude.Maybe Prelude.Text)+deletePermission_sourceAccount = Lens.lens (\DeletePermission' {sourceAccount} -> sourceAccount) (\s@DeletePermission' {} a -> s {sourceAccount = a} :: DeletePermission)++-- | The Amazon Resource Number (ARN) of the private CA that issued the+-- permissions. You can find the CA\'s ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. This must have the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+deletePermission_certificateAuthorityArn :: Lens.Lens' DeletePermission Prelude.Text+deletePermission_certificateAuthorityArn = Lens.lens (\DeletePermission' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@DeletePermission' {} a -> s {certificateAuthorityArn = a} :: DeletePermission)++-- | The Amazon Web Services service or identity that will have its CA+-- permissions revoked. At this time, the only valid service principal is+-- @acm.amazonaws.com@+deletePermission_principal :: Lens.Lens' DeletePermission Prelude.Text+deletePermission_principal = Lens.lens (\DeletePermission' {principal} -> principal) (\s@DeletePermission' {} a -> s {principal = a} :: DeletePermission)++instance Core.AWSRequest DeletePermission where+  type+    AWSResponse DeletePermission =+      DeletePermissionResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveNull DeletePermissionResponse'++instance Prelude.Hashable DeletePermission where+  hashWithSalt _salt DeletePermission' {..} =+    _salt+      `Prelude.hashWithSalt` sourceAccount+      `Prelude.hashWithSalt` certificateAuthorityArn+      `Prelude.hashWithSalt` principal++instance Prelude.NFData DeletePermission where+  rnf DeletePermission' {..} =+    Prelude.rnf sourceAccount+      `Prelude.seq` Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf principal++instance Data.ToHeaders DeletePermission where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.DeletePermission" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON DeletePermission where+  toJSON DeletePermission' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("SourceAccount" Data..=) Prelude.<$> sourceAccount,+            Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just ("Principal" Data..= principal)+          ]+      )++instance Data.ToPath DeletePermission where+  toPath = Prelude.const "/"++instance Data.ToQuery DeletePermission where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newDeletePermissionResponse' smart constructor.+data DeletePermissionResponse = DeletePermissionResponse'+  {+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeletePermissionResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+newDeletePermissionResponse ::+  DeletePermissionResponse+newDeletePermissionResponse =+  DeletePermissionResponse'++instance Prelude.NFData DeletePermissionResponse where+  rnf _ = ()

@@ -0,0 +1,175 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.DeletePolicy+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Deletes the resource-based policy attached to a private CA. Deletion+-- will remove any access that the policy has granted. If there is no+-- policy attached to the private CA, this action will return successful.+--+-- If you delete a policy that was applied through Amazon Web Services+-- Resource Access Manager (RAM), the CA will be removed from all shares in+-- which it was included.+--+-- The Certificate Manager Service Linked Role that the policy supports is+-- not affected when you delete the policy.+--+-- The current policy can be shown with+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetPolicy.html GetPolicy>+-- and updated with+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_PutPolicy.html PutPolicy>.+--+-- __About Policies__+--+-- -   A policy grants access on a private CA to an Amazon Web Services+--     customer account, to Amazon Web Services Organizations, or to an+--     Amazon Web Services Organizations unit. Policies are under the+--     control of a CA administrator. For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html Using a Resource Based Policy with Amazon Web Services Private CA>.+--+-- -   A policy permits a user of Certificate Manager (ACM) to issue ACM+--     certificates signed by a CA in another account.+--+-- -   For ACM to manage automatic renewal of these certificates, the ACM+--     user must configure a Service Linked Role (SLR). The SLR allows the+--     ACM service to assume the identity of the user, subject to+--     confirmation against the Amazon Web Services Private CA policy. For+--     more information, see+--     <https://docs.aws.amazon.com/acm/latest/userguide/acm-slr.html Using a Service Linked Role with ACM>.+--+-- -   Updates made in Amazon Web Services Resource Manager (RAM) are+--     reflected in policies. For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-ram.html Attach a Policy for Cross-Account Access>.+module Amazonka.CertificateManagerPCA.DeletePolicy+  ( -- * Creating a Request+    DeletePolicy (..),+    newDeletePolicy,++    -- * Request Lenses+    deletePolicy_resourceArn,++    -- * Destructuring the Response+    DeletePolicyResponse (..),+    newDeletePolicyResponse,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newDeletePolicy' smart constructor.+data DeletePolicy = DeletePolicy'+  { -- | The Amazon Resource Number (ARN) of the private CA that will have its+    -- policy deleted. You can find the CA\'s ARN by calling the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+    -- action. The ARN value must have the form+    -- @arn:aws:acm-pca:region:account:certificate-authority\/01234567-89ab-cdef-0123-0123456789ab@.+    resourceArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeletePolicy' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'resourceArn', 'deletePolicy_resourceArn' - The Amazon Resource Number (ARN) of the private CA that will have its+-- policy deleted. You can find the CA\'s ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. The ARN value must have the form+-- @arn:aws:acm-pca:region:account:certificate-authority\/01234567-89ab-cdef-0123-0123456789ab@.+newDeletePolicy ::+  -- | 'resourceArn'+  Prelude.Text ->+  DeletePolicy+newDeletePolicy pResourceArn_ =+  DeletePolicy' {resourceArn = pResourceArn_}++-- | The Amazon Resource Number (ARN) of the private CA that will have its+-- policy deleted. You can find the CA\'s ARN by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html ListCertificateAuthorities>+-- action. The ARN value must have the form+-- @arn:aws:acm-pca:region:account:certificate-authority\/01234567-89ab-cdef-0123-0123456789ab@.+deletePolicy_resourceArn :: Lens.Lens' DeletePolicy Prelude.Text+deletePolicy_resourceArn = Lens.lens (\DeletePolicy' {resourceArn} -> resourceArn) (\s@DeletePolicy' {} a -> s {resourceArn = a} :: DeletePolicy)++instance Core.AWSRequest DeletePolicy where+  type AWSResponse DeletePolicy = DeletePolicyResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response = Response.receiveNull DeletePolicyResponse'++instance Prelude.Hashable DeletePolicy where+  hashWithSalt _salt DeletePolicy' {..} =+    _salt `Prelude.hashWithSalt` resourceArn++instance Prelude.NFData DeletePolicy where+  rnf DeletePolicy' {..} = Prelude.rnf resourceArn++instance Data.ToHeaders DeletePolicy where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ("ACMPrivateCA.DeletePolicy" :: Prelude.ByteString),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON DeletePolicy where+  toJSON DeletePolicy' {..} =+    Data.object+      ( Prelude.catMaybes+          [Prelude.Just ("ResourceArn" Data..= resourceArn)]+      )++instance Data.ToPath DeletePolicy where+  toPath = Prelude.const "/"++instance Data.ToQuery DeletePolicy where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newDeletePolicyResponse' smart constructor.+data DeletePolicyResponse = DeletePolicyResponse'+  {+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DeletePolicyResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+newDeletePolicyResponse ::+  DeletePolicyResponse+newDeletePolicyResponse = DeletePolicyResponse'++instance Prelude.NFData DeletePolicyResponse where+  rnf _ = ()

@@ -0,0 +1,228 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.DescribeCertificateAuthority+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Lists information about your private certificate authority (CA) or one+-- that has been shared with you. You specify the private CA on input by+-- its ARN (Amazon Resource Name). The output contains the status of your+-- CA. This can be any of the following:+--+-- -   @CREATING@ - Amazon Web Services Private CA is creating your private+--     certificate authority.+--+-- -   @PENDING_CERTIFICATE@ - The certificate is pending. You must use+--     your Amazon Web Services Private CA-hosted or on-premises root or+--     subordinate CA to sign your private CA CSR and then import it into+--     Amazon Web Services Private CA.+--+-- -   @ACTIVE@ - Your private CA is active.+--+-- -   @DISABLED@ - Your private CA has been disabled.+--+-- -   @EXPIRED@ - Your private CA certificate has expired.+--+-- -   @FAILED@ - Your private CA has failed. Your CA can fail because of+--     problems such a network outage or back-end Amazon Web Services+--     failure or other errors. A failed CA can never return to the pending+--     state. You must create a new CA.+--+-- -   @DELETED@ - Your private CA is within the restoration period, after+--     which it is permanently deleted. The length of time remaining in the+--     CA\'s restoration period is also included in this action\'s output.+module Amazonka.CertificateManagerPCA.DescribeCertificateAuthority+  ( -- * Creating a Request+    DescribeCertificateAuthority (..),+    newDescribeCertificateAuthority,++    -- * Request Lenses+    describeCertificateAuthority_certificateAuthorityArn,++    -- * Destructuring the Response+    DescribeCertificateAuthorityResponse (..),+    newDescribeCertificateAuthorityResponse,++    -- * Response Lenses+    describeCertificateAuthorityResponse_certificateAuthority,+    describeCertificateAuthorityResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newDescribeCertificateAuthority' smart constructor.+data DescribeCertificateAuthority = DescribeCertificateAuthority'+  { -- | The Amazon Resource Name (ARN) that was returned when you called+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+    -- This must be of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DescribeCertificateAuthority' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'describeCertificateAuthority_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+newDescribeCertificateAuthority ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  DescribeCertificateAuthority+newDescribeCertificateAuthority+  pCertificateAuthorityArn_ =+    DescribeCertificateAuthority'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_+      }++-- | The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+describeCertificateAuthority_certificateAuthorityArn :: Lens.Lens' DescribeCertificateAuthority Prelude.Text+describeCertificateAuthority_certificateAuthorityArn = Lens.lens (\DescribeCertificateAuthority' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@DescribeCertificateAuthority' {} a -> s {certificateAuthorityArn = a} :: DescribeCertificateAuthority)++instance Core.AWSRequest DescribeCertificateAuthority where+  type+    AWSResponse DescribeCertificateAuthority =+      DescribeCertificateAuthorityResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          DescribeCertificateAuthorityResponse'+            Prelude.<$> (x Data..?> "CertificateAuthority")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance+  Prelude.Hashable+    DescribeCertificateAuthority+  where+  hashWithSalt _salt DescribeCertificateAuthority' {..} =+    _salt+      `Prelude.hashWithSalt` certificateAuthorityArn++instance Prelude.NFData DescribeCertificateAuthority where+  rnf DescribeCertificateAuthority' {..} =+    Prelude.rnf certificateAuthorityArn++instance Data.ToHeaders DescribeCertificateAuthority where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.DescribeCertificateAuthority" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON DescribeCertificateAuthority where+  toJSON DescribeCertificateAuthority' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              )+          ]+      )++instance Data.ToPath DescribeCertificateAuthority where+  toPath = Prelude.const "/"++instance Data.ToQuery DescribeCertificateAuthority where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newDescribeCertificateAuthorityResponse' smart constructor.+data DescribeCertificateAuthorityResponse = DescribeCertificateAuthorityResponse'+  { -- | A+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthority.html CertificateAuthority>+    -- structure that contains information about your private CA.+    certificateAuthority :: Prelude.Maybe CertificateAuthority,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DescribeCertificateAuthorityResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthority', 'describeCertificateAuthorityResponse_certificateAuthority' - A+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthority.html CertificateAuthority>+-- structure that contains information about your private CA.+--+-- 'httpStatus', 'describeCertificateAuthorityResponse_httpStatus' - The response's http status code.+newDescribeCertificateAuthorityResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  DescribeCertificateAuthorityResponse+newDescribeCertificateAuthorityResponse pHttpStatus_ =+  DescribeCertificateAuthorityResponse'+    { certificateAuthority =+        Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | A+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthority.html CertificateAuthority>+-- structure that contains information about your private CA.+describeCertificateAuthorityResponse_certificateAuthority :: Lens.Lens' DescribeCertificateAuthorityResponse (Prelude.Maybe CertificateAuthority)+describeCertificateAuthorityResponse_certificateAuthority = Lens.lens (\DescribeCertificateAuthorityResponse' {certificateAuthority} -> certificateAuthority) (\s@DescribeCertificateAuthorityResponse' {} a -> s {certificateAuthority = a} :: DescribeCertificateAuthorityResponse)++-- | The response's http status code.+describeCertificateAuthorityResponse_httpStatus :: Lens.Lens' DescribeCertificateAuthorityResponse Prelude.Int+describeCertificateAuthorityResponse_httpStatus = Lens.lens (\DescribeCertificateAuthorityResponse' {httpStatus} -> httpStatus) (\s@DescribeCertificateAuthorityResponse' {} a -> s {httpStatus = a} :: DescribeCertificateAuthorityResponse)++instance+  Prelude.NFData+    DescribeCertificateAuthorityResponse+  where+  rnf DescribeCertificateAuthorityResponse' {..} =+    Prelude.rnf certificateAuthority+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,288 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.DescribeCertificateAuthorityAuditReport+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Lists information about a specific audit report created by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html CreateCertificateAuthorityAuditReport>+-- action. Audit information is created every time the certificate+-- authority (CA) private key is used. The private key is used when you+-- call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html IssueCertificate>+-- action or the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html RevokeCertificate>+-- action.+module Amazonka.CertificateManagerPCA.DescribeCertificateAuthorityAuditReport+  ( -- * Creating a Request+    DescribeCertificateAuthorityAuditReport (..),+    newDescribeCertificateAuthorityAuditReport,++    -- * Request Lenses+    describeCertificateAuthorityAuditReport_certificateAuthorityArn,+    describeCertificateAuthorityAuditReport_auditReportId,++    -- * Destructuring the Response+    DescribeCertificateAuthorityAuditReportResponse (..),+    newDescribeCertificateAuthorityAuditReportResponse,++    -- * Response Lenses+    describeCertificateAuthorityAuditReportResponse_auditReportStatus,+    describeCertificateAuthorityAuditReportResponse_createdAt,+    describeCertificateAuthorityAuditReportResponse_s3BucketName,+    describeCertificateAuthorityAuditReportResponse_s3Key,+    describeCertificateAuthorityAuditReportResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newDescribeCertificateAuthorityAuditReport' smart constructor.+data DescribeCertificateAuthorityAuditReport = DescribeCertificateAuthorityAuditReport'+  { -- | The Amazon Resource Name (ARN) of the private CA. This must be of the+    -- form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text,+    -- | The report ID returned by calling the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html CreateCertificateAuthorityAuditReport>+    -- action.+    auditReportId :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DescribeCertificateAuthorityAuditReport' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'describeCertificateAuthorityAuditReport_certificateAuthorityArn' - The Amazon Resource Name (ARN) of the private CA. This must be of the+-- form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 'auditReportId', 'describeCertificateAuthorityAuditReport_auditReportId' - The report ID returned by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html CreateCertificateAuthorityAuditReport>+-- action.+newDescribeCertificateAuthorityAuditReport ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'auditReportId'+  Prelude.Text ->+  DescribeCertificateAuthorityAuditReport+newDescribeCertificateAuthorityAuditReport+  pCertificateAuthorityArn_+  pAuditReportId_ =+    DescribeCertificateAuthorityAuditReport'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_,+        auditReportId = pAuditReportId_+      }++-- | The Amazon Resource Name (ARN) of the private CA. This must be of the+-- form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+describeCertificateAuthorityAuditReport_certificateAuthorityArn :: Lens.Lens' DescribeCertificateAuthorityAuditReport Prelude.Text+describeCertificateAuthorityAuditReport_certificateAuthorityArn = Lens.lens (\DescribeCertificateAuthorityAuditReport' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@DescribeCertificateAuthorityAuditReport' {} a -> s {certificateAuthorityArn = a} :: DescribeCertificateAuthorityAuditReport)++-- | The report ID returned by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html CreateCertificateAuthorityAuditReport>+-- action.+describeCertificateAuthorityAuditReport_auditReportId :: Lens.Lens' DescribeCertificateAuthorityAuditReport Prelude.Text+describeCertificateAuthorityAuditReport_auditReportId = Lens.lens (\DescribeCertificateAuthorityAuditReport' {auditReportId} -> auditReportId) (\s@DescribeCertificateAuthorityAuditReport' {} a -> s {auditReportId = a} :: DescribeCertificateAuthorityAuditReport)++instance+  Core.AWSRequest+    DescribeCertificateAuthorityAuditReport+  where+  type+    AWSResponse+      DescribeCertificateAuthorityAuditReport =+      DescribeCertificateAuthorityAuditReportResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          DescribeCertificateAuthorityAuditReportResponse'+            Prelude.<$> (x Data..?> "AuditReportStatus")+            Prelude.<*> (x Data..?> "CreatedAt")+            Prelude.<*> (x Data..?> "S3BucketName")+            Prelude.<*> (x Data..?> "S3Key")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance+  Prelude.Hashable+    DescribeCertificateAuthorityAuditReport+  where+  hashWithSalt+    _salt+    DescribeCertificateAuthorityAuditReport' {..} =+      _salt+        `Prelude.hashWithSalt` certificateAuthorityArn+        `Prelude.hashWithSalt` auditReportId++instance+  Prelude.NFData+    DescribeCertificateAuthorityAuditReport+  where+  rnf DescribeCertificateAuthorityAuditReport' {..} =+    Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf auditReportId++instance+  Data.ToHeaders+    DescribeCertificateAuthorityAuditReport+  where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.DescribeCertificateAuthorityAuditReport" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance+  Data.ToJSON+    DescribeCertificateAuthorityAuditReport+  where+  toJSON DescribeCertificateAuthorityAuditReport' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just+              ("AuditReportId" Data..= auditReportId)+          ]+      )++instance+  Data.ToPath+    DescribeCertificateAuthorityAuditReport+  where+  toPath = Prelude.const "/"++instance+  Data.ToQuery+    DescribeCertificateAuthorityAuditReport+  where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newDescribeCertificateAuthorityAuditReportResponse' smart constructor.+data DescribeCertificateAuthorityAuditReportResponse = DescribeCertificateAuthorityAuditReportResponse'+  { -- | Specifies whether report creation is in progress, has succeeded, or has+    -- failed.+    auditReportStatus :: Prelude.Maybe AuditReportStatus,+    -- | The date and time at which the report was created.+    createdAt :: Prelude.Maybe Data.POSIX,+    -- | Name of the S3 bucket that contains the report.+    s3BucketName :: Prelude.Maybe Prelude.Text,+    -- | S3 __key__ that uniquely identifies the report file in your S3 bucket.+    s3Key :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'DescribeCertificateAuthorityAuditReportResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'auditReportStatus', 'describeCertificateAuthorityAuditReportResponse_auditReportStatus' - Specifies whether report creation is in progress, has succeeded, or has+-- failed.+--+-- 'createdAt', 'describeCertificateAuthorityAuditReportResponse_createdAt' - The date and time at which the report was created.+--+-- 's3BucketName', 'describeCertificateAuthorityAuditReportResponse_s3BucketName' - Name of the S3 bucket that contains the report.+--+-- 's3Key', 'describeCertificateAuthorityAuditReportResponse_s3Key' - S3 __key__ that uniquely identifies the report file in your S3 bucket.+--+-- 'httpStatus', 'describeCertificateAuthorityAuditReportResponse_httpStatus' - The response's http status code.+newDescribeCertificateAuthorityAuditReportResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  DescribeCertificateAuthorityAuditReportResponse+newDescribeCertificateAuthorityAuditReportResponse+  pHttpStatus_ =+    DescribeCertificateAuthorityAuditReportResponse'+      { auditReportStatus =+          Prelude.Nothing,+        createdAt =+          Prelude.Nothing,+        s3BucketName =+          Prelude.Nothing,+        s3Key = Prelude.Nothing,+        httpStatus = pHttpStatus_+      }++-- | Specifies whether report creation is in progress, has succeeded, or has+-- failed.+describeCertificateAuthorityAuditReportResponse_auditReportStatus :: Lens.Lens' DescribeCertificateAuthorityAuditReportResponse (Prelude.Maybe AuditReportStatus)+describeCertificateAuthorityAuditReportResponse_auditReportStatus = Lens.lens (\DescribeCertificateAuthorityAuditReportResponse' {auditReportStatus} -> auditReportStatus) (\s@DescribeCertificateAuthorityAuditReportResponse' {} a -> s {auditReportStatus = a} :: DescribeCertificateAuthorityAuditReportResponse)++-- | The date and time at which the report was created.+describeCertificateAuthorityAuditReportResponse_createdAt :: Lens.Lens' DescribeCertificateAuthorityAuditReportResponse (Prelude.Maybe Prelude.UTCTime)+describeCertificateAuthorityAuditReportResponse_createdAt = Lens.lens (\DescribeCertificateAuthorityAuditReportResponse' {createdAt} -> createdAt) (\s@DescribeCertificateAuthorityAuditReportResponse' {} a -> s {createdAt = a} :: DescribeCertificateAuthorityAuditReportResponse) Prelude.. Lens.mapping Data._Time++-- | Name of the S3 bucket that contains the report.+describeCertificateAuthorityAuditReportResponse_s3BucketName :: Lens.Lens' DescribeCertificateAuthorityAuditReportResponse (Prelude.Maybe Prelude.Text)+describeCertificateAuthorityAuditReportResponse_s3BucketName = Lens.lens (\DescribeCertificateAuthorityAuditReportResponse' {s3BucketName} -> s3BucketName) (\s@DescribeCertificateAuthorityAuditReportResponse' {} a -> s {s3BucketName = a} :: DescribeCertificateAuthorityAuditReportResponse)++-- | S3 __key__ that uniquely identifies the report file in your S3 bucket.+describeCertificateAuthorityAuditReportResponse_s3Key :: Lens.Lens' DescribeCertificateAuthorityAuditReportResponse (Prelude.Maybe Prelude.Text)+describeCertificateAuthorityAuditReportResponse_s3Key = Lens.lens (\DescribeCertificateAuthorityAuditReportResponse' {s3Key} -> s3Key) (\s@DescribeCertificateAuthorityAuditReportResponse' {} a -> s {s3Key = a} :: DescribeCertificateAuthorityAuditReportResponse)++-- | The response's http status code.+describeCertificateAuthorityAuditReportResponse_httpStatus :: Lens.Lens' DescribeCertificateAuthorityAuditReportResponse Prelude.Int+describeCertificateAuthorityAuditReportResponse_httpStatus = Lens.lens (\DescribeCertificateAuthorityAuditReportResponse' {httpStatus} -> httpStatus) (\s@DescribeCertificateAuthorityAuditReportResponse' {} a -> s {httpStatus = a} :: DescribeCertificateAuthorityAuditReportResponse)++instance+  Prelude.NFData+    DescribeCertificateAuthorityAuditReportResponse+  where+  rnf+    DescribeCertificateAuthorityAuditReportResponse' {..} =+      Prelude.rnf auditReportStatus+        `Prelude.seq` Prelude.rnf createdAt+        `Prelude.seq` Prelude.rnf s3BucketName+        `Prelude.seq` Prelude.rnf s3Key+        `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,243 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.GetCertificate+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Retrieves a certificate from your private CA or one that has been shared+-- with you. The ARN of the certificate is returned when you call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html IssueCertificate>+-- action. You must specify both the ARN of your private CA and the ARN of+-- the issued certificate when calling the __GetCertificate__ action. You+-- can retrieve the certificate if it is in the __ISSUED__ state. You can+-- call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html CreateCertificateAuthorityAuditReport>+-- action to create a report that contains information about all of the+-- certificates issued and revoked by your private CA.+module Amazonka.CertificateManagerPCA.GetCertificate+  ( -- * Creating a Request+    GetCertificate (..),+    newGetCertificate,++    -- * Request Lenses+    getCertificate_certificateAuthorityArn,+    getCertificate_certificateArn,++    -- * Destructuring the Response+    GetCertificateResponse (..),+    newGetCertificateResponse,++    -- * Response Lenses+    getCertificateResponse_certificate,+    getCertificateResponse_certificateChain,+    getCertificateResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newGetCertificate' smart constructor.+data GetCertificate = GetCertificate'+  { -- | The Amazon Resource Name (ARN) that was returned when you called+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+    -- This must be of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text,+    -- | The ARN of the issued certificate. The ARN contains the certificate+    -- serial number and must be in the following form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+    certificateArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificate' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'getCertificate_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+--+-- 'certificateArn', 'getCertificate_certificateArn' - The ARN of the issued certificate. The ARN contains the certificate+-- serial number and must be in the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+newGetCertificate ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'certificateArn'+  Prelude.Text ->+  GetCertificate+newGetCertificate+  pCertificateAuthorityArn_+  pCertificateArn_ =+    GetCertificate'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_,+        certificateArn = pCertificateArn_+      }++-- | The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+getCertificate_certificateAuthorityArn :: Lens.Lens' GetCertificate Prelude.Text+getCertificate_certificateAuthorityArn = Lens.lens (\GetCertificate' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@GetCertificate' {} a -> s {certificateAuthorityArn = a} :: GetCertificate)++-- | The ARN of the issued certificate. The ARN contains the certificate+-- serial number and must be in the following form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+getCertificate_certificateArn :: Lens.Lens' GetCertificate Prelude.Text+getCertificate_certificateArn = Lens.lens (\GetCertificate' {certificateArn} -> certificateArn) (\s@GetCertificate' {} a -> s {certificateArn = a} :: GetCertificate)++instance Core.AWSRequest GetCertificate where+  type+    AWSResponse GetCertificate =+      GetCertificateResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          GetCertificateResponse'+            Prelude.<$> (x Data..?> "Certificate")+            Prelude.<*> (x Data..?> "CertificateChain")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance Prelude.Hashable GetCertificate where+  hashWithSalt _salt GetCertificate' {..} =+    _salt+      `Prelude.hashWithSalt` certificateAuthorityArn+      `Prelude.hashWithSalt` certificateArn++instance Prelude.NFData GetCertificate where+  rnf GetCertificate' {..} =+    Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf certificateArn++instance Data.ToHeaders GetCertificate where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.GetCertificate" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON GetCertificate where+  toJSON GetCertificate' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just+              ("CertificateArn" Data..= certificateArn)+          ]+      )++instance Data.ToPath GetCertificate where+  toPath = Prelude.const "/"++instance Data.ToQuery GetCertificate where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newGetCertificateResponse' smart constructor.+data GetCertificateResponse = GetCertificateResponse'+  { -- | The base64 PEM-encoded certificate specified by the @CertificateArn@+    -- parameter.+    certificate :: Prelude.Maybe Prelude.Text,+    -- | The base64 PEM-encoded certificate chain that chains up to the root CA+    -- certificate that you used to sign your private CA certificate.+    certificateChain :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificateResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificate', 'getCertificateResponse_certificate' - The base64 PEM-encoded certificate specified by the @CertificateArn@+-- parameter.+--+-- 'certificateChain', 'getCertificateResponse_certificateChain' - The base64 PEM-encoded certificate chain that chains up to the root CA+-- certificate that you used to sign your private CA certificate.+--+-- 'httpStatus', 'getCertificateResponse_httpStatus' - The response's http status code.+newGetCertificateResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  GetCertificateResponse+newGetCertificateResponse pHttpStatus_ =+  GetCertificateResponse'+    { certificate =+        Prelude.Nothing,+      certificateChain = Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | The base64 PEM-encoded certificate specified by the @CertificateArn@+-- parameter.+getCertificateResponse_certificate :: Lens.Lens' GetCertificateResponse (Prelude.Maybe Prelude.Text)+getCertificateResponse_certificate = Lens.lens (\GetCertificateResponse' {certificate} -> certificate) (\s@GetCertificateResponse' {} a -> s {certificate = a} :: GetCertificateResponse)++-- | The base64 PEM-encoded certificate chain that chains up to the root CA+-- certificate that you used to sign your private CA certificate.+getCertificateResponse_certificateChain :: Lens.Lens' GetCertificateResponse (Prelude.Maybe Prelude.Text)+getCertificateResponse_certificateChain = Lens.lens (\GetCertificateResponse' {certificateChain} -> certificateChain) (\s@GetCertificateResponse' {} a -> s {certificateChain = a} :: GetCertificateResponse)++-- | The response's http status code.+getCertificateResponse_httpStatus :: Lens.Lens' GetCertificateResponse Prelude.Int+getCertificateResponse_httpStatus = Lens.lens (\GetCertificateResponse' {httpStatus} -> httpStatus) (\s@GetCertificateResponse' {} a -> s {httpStatus = a} :: GetCertificateResponse)++instance Prelude.NFData GetCertificateResponse where+  rnf GetCertificateResponse' {..} =+    Prelude.rnf certificate+      `Prelude.seq` Prelude.rnf certificateChain+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,237 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.GetCertificateAuthorityCertificate+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Retrieves the certificate and certificate chain for your private+-- certificate authority (CA) or one that has been shared with you. Both+-- the certificate and the chain are base64 PEM-encoded. The chain does not+-- include the CA certificate. Each certificate in the chain signs the one+-- before it.+module Amazonka.CertificateManagerPCA.GetCertificateAuthorityCertificate+  ( -- * Creating a Request+    GetCertificateAuthorityCertificate (..),+    newGetCertificateAuthorityCertificate,++    -- * Request Lenses+    getCertificateAuthorityCertificate_certificateAuthorityArn,++    -- * Destructuring the Response+    GetCertificateAuthorityCertificateResponse (..),+    newGetCertificateAuthorityCertificateResponse,++    -- * Response Lenses+    getCertificateAuthorityCertificateResponse_certificate,+    getCertificateAuthorityCertificateResponse_certificateChain,+    getCertificateAuthorityCertificateResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newGetCertificateAuthorityCertificate' smart constructor.+data GetCertificateAuthorityCertificate = GetCertificateAuthorityCertificate'+  { -- | The Amazon Resource Name (ARN) of your private CA. This is of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+    certificateAuthorityArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificateAuthorityCertificate' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'getCertificateAuthorityCertificate_certificateAuthorityArn' - The Amazon Resource Name (ARN) of your private CA. This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+newGetCertificateAuthorityCertificate ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  GetCertificateAuthorityCertificate+newGetCertificateAuthorityCertificate+  pCertificateAuthorityArn_ =+    GetCertificateAuthorityCertificate'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_+      }++-- | The Amazon Resource Name (ARN) of your private CA. This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @.+getCertificateAuthorityCertificate_certificateAuthorityArn :: Lens.Lens' GetCertificateAuthorityCertificate Prelude.Text+getCertificateAuthorityCertificate_certificateAuthorityArn = Lens.lens (\GetCertificateAuthorityCertificate' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@GetCertificateAuthorityCertificate' {} a -> s {certificateAuthorityArn = a} :: GetCertificateAuthorityCertificate)++instance+  Core.AWSRequest+    GetCertificateAuthorityCertificate+  where+  type+    AWSResponse GetCertificateAuthorityCertificate =+      GetCertificateAuthorityCertificateResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          GetCertificateAuthorityCertificateResponse'+            Prelude.<$> (x Data..?> "Certificate")+            Prelude.<*> (x Data..?> "CertificateChain")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance+  Prelude.Hashable+    GetCertificateAuthorityCertificate+  where+  hashWithSalt+    _salt+    GetCertificateAuthorityCertificate' {..} =+      _salt+        `Prelude.hashWithSalt` certificateAuthorityArn++instance+  Prelude.NFData+    GetCertificateAuthorityCertificate+  where+  rnf GetCertificateAuthorityCertificate' {..} =+    Prelude.rnf certificateAuthorityArn++instance+  Data.ToHeaders+    GetCertificateAuthorityCertificate+  where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.GetCertificateAuthorityCertificate" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance+  Data.ToJSON+    GetCertificateAuthorityCertificate+  where+  toJSON GetCertificateAuthorityCertificate' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              )+          ]+      )++instance+  Data.ToPath+    GetCertificateAuthorityCertificate+  where+  toPath = Prelude.const "/"++instance+  Data.ToQuery+    GetCertificateAuthorityCertificate+  where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newGetCertificateAuthorityCertificateResponse' smart constructor.+data GetCertificateAuthorityCertificateResponse = GetCertificateAuthorityCertificateResponse'+  { -- | Base64-encoded certificate authority (CA) certificate.+    certificate :: Prelude.Maybe Prelude.Text,+    -- | Base64-encoded certificate chain that includes any intermediate+    -- certificates and chains up to root certificate that you used to sign+    -- your private CA certificate. The chain does not include your private CA+    -- certificate. If this is a root CA, the value will be null.+    certificateChain :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificateAuthorityCertificateResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificate', 'getCertificateAuthorityCertificateResponse_certificate' - Base64-encoded certificate authority (CA) certificate.+--+-- 'certificateChain', 'getCertificateAuthorityCertificateResponse_certificateChain' - Base64-encoded certificate chain that includes any intermediate+-- certificates and chains up to root certificate that you used to sign+-- your private CA certificate. The chain does not include your private CA+-- certificate. If this is a root CA, the value will be null.+--+-- 'httpStatus', 'getCertificateAuthorityCertificateResponse_httpStatus' - The response's http status code.+newGetCertificateAuthorityCertificateResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  GetCertificateAuthorityCertificateResponse+newGetCertificateAuthorityCertificateResponse+  pHttpStatus_ =+    GetCertificateAuthorityCertificateResponse'+      { certificate =+          Prelude.Nothing,+        certificateChain =+          Prelude.Nothing,+        httpStatus = pHttpStatus_+      }++-- | Base64-encoded certificate authority (CA) certificate.+getCertificateAuthorityCertificateResponse_certificate :: Lens.Lens' GetCertificateAuthorityCertificateResponse (Prelude.Maybe Prelude.Text)+getCertificateAuthorityCertificateResponse_certificate = Lens.lens (\GetCertificateAuthorityCertificateResponse' {certificate} -> certificate) (\s@GetCertificateAuthorityCertificateResponse' {} a -> s {certificate = a} :: GetCertificateAuthorityCertificateResponse)++-- | Base64-encoded certificate chain that includes any intermediate+-- certificates and chains up to root certificate that you used to sign+-- your private CA certificate. The chain does not include your private CA+-- certificate. If this is a root CA, the value will be null.+getCertificateAuthorityCertificateResponse_certificateChain :: Lens.Lens' GetCertificateAuthorityCertificateResponse (Prelude.Maybe Prelude.Text)+getCertificateAuthorityCertificateResponse_certificateChain = Lens.lens (\GetCertificateAuthorityCertificateResponse' {certificateChain} -> certificateChain) (\s@GetCertificateAuthorityCertificateResponse' {} a -> s {certificateChain = a} :: GetCertificateAuthorityCertificateResponse)++-- | The response's http status code.+getCertificateAuthorityCertificateResponse_httpStatus :: Lens.Lens' GetCertificateAuthorityCertificateResponse Prelude.Int+getCertificateAuthorityCertificateResponse_httpStatus = Lens.lens (\GetCertificateAuthorityCertificateResponse' {httpStatus} -> httpStatus) (\s@GetCertificateAuthorityCertificateResponse' {} a -> s {httpStatus = a} :: GetCertificateAuthorityCertificateResponse)++instance+  Prelude.NFData+    GetCertificateAuthorityCertificateResponse+  where+  rnf GetCertificateAuthorityCertificateResponse' {..} =+    Prelude.rnf certificate+      `Prelude.seq` Prelude.rnf certificateChain+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,203 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.GetCertificateAuthorityCsr+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Retrieves the certificate signing request (CSR) for your private+-- certificate authority (CA). The CSR is created when you call the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>+-- action. Sign the CSR with your Amazon Web Services Private CA-hosted or+-- on-premises root or subordinate CA. Then import the signed certificate+-- back into Amazon Web Services Private CA by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html ImportCertificateAuthorityCertificate>+-- action. The CSR is returned as a base64 PEM-encoded string.+module Amazonka.CertificateManagerPCA.GetCertificateAuthorityCsr+  ( -- * Creating a Request+    GetCertificateAuthorityCsr (..),+    newGetCertificateAuthorityCsr,++    -- * Request Lenses+    getCertificateAuthorityCsr_certificateAuthorityArn,++    -- * Destructuring the Response+    GetCertificateAuthorityCsrResponse (..),+    newGetCertificateAuthorityCsrResponse,++    -- * Response Lenses+    getCertificateAuthorityCsrResponse_csr,+    getCertificateAuthorityCsrResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newGetCertificateAuthorityCsr' smart constructor.+data GetCertificateAuthorityCsr = GetCertificateAuthorityCsr'+  { -- | The Amazon Resource Name (ARN) that was returned when you called the+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>+    -- action. This must be of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+    certificateAuthorityArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificateAuthorityCsr' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateAuthorityArn', 'getCertificateAuthorityCsr_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>+-- action. This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+newGetCertificateAuthorityCsr ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  GetCertificateAuthorityCsr+newGetCertificateAuthorityCsr+  pCertificateAuthorityArn_ =+    GetCertificateAuthorityCsr'+      { certificateAuthorityArn =+          pCertificateAuthorityArn_+      }++-- | The Amazon Resource Name (ARN) that was returned when you called the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>+-- action. This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+getCertificateAuthorityCsr_certificateAuthorityArn :: Lens.Lens' GetCertificateAuthorityCsr Prelude.Text+getCertificateAuthorityCsr_certificateAuthorityArn = Lens.lens (\GetCertificateAuthorityCsr' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@GetCertificateAuthorityCsr' {} a -> s {certificateAuthorityArn = a} :: GetCertificateAuthorityCsr)++instance Core.AWSRequest GetCertificateAuthorityCsr where+  type+    AWSResponse GetCertificateAuthorityCsr =+      GetCertificateAuthorityCsrResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          GetCertificateAuthorityCsrResponse'+            Prelude.<$> (x Data..?> "Csr")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance Prelude.Hashable GetCertificateAuthorityCsr where+  hashWithSalt _salt GetCertificateAuthorityCsr' {..} =+    _salt+      `Prelude.hashWithSalt` certificateAuthorityArn++instance Prelude.NFData GetCertificateAuthorityCsr where+  rnf GetCertificateAuthorityCsr' {..} =+    Prelude.rnf certificateAuthorityArn++instance Data.ToHeaders GetCertificateAuthorityCsr where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.GetCertificateAuthorityCsr" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON GetCertificateAuthorityCsr where+  toJSON GetCertificateAuthorityCsr' {..} =+    Data.object+      ( Prelude.catMaybes+          [ Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              )+          ]+      )++instance Data.ToPath GetCertificateAuthorityCsr where+  toPath = Prelude.const "/"++instance Data.ToQuery GetCertificateAuthorityCsr where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newGetCertificateAuthorityCsrResponse' smart constructor.+data GetCertificateAuthorityCsrResponse = GetCertificateAuthorityCsrResponse'+  { -- | The base64 PEM-encoded certificate signing request (CSR) for your+    -- private CA certificate.+    csr :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetCertificateAuthorityCsrResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'csr', 'getCertificateAuthorityCsrResponse_csr' - The base64 PEM-encoded certificate signing request (CSR) for your+-- private CA certificate.+--+-- 'httpStatus', 'getCertificateAuthorityCsrResponse_httpStatus' - The response's http status code.+newGetCertificateAuthorityCsrResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  GetCertificateAuthorityCsrResponse+newGetCertificateAuthorityCsrResponse pHttpStatus_ =+  GetCertificateAuthorityCsrResponse'+    { csr =+        Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | The base64 PEM-encoded certificate signing request (CSR) for your+-- private CA certificate.+getCertificateAuthorityCsrResponse_csr :: Lens.Lens' GetCertificateAuthorityCsrResponse (Prelude.Maybe Prelude.Text)+getCertificateAuthorityCsrResponse_csr = Lens.lens (\GetCertificateAuthorityCsrResponse' {csr} -> csr) (\s@GetCertificateAuthorityCsrResponse' {} a -> s {csr = a} :: GetCertificateAuthorityCsrResponse)++-- | The response's http status code.+getCertificateAuthorityCsrResponse_httpStatus :: Lens.Lens' GetCertificateAuthorityCsrResponse Prelude.Int+getCertificateAuthorityCsrResponse_httpStatus = Lens.lens (\GetCertificateAuthorityCsrResponse' {httpStatus} -> httpStatus) (\s@GetCertificateAuthorityCsrResponse' {} a -> s {httpStatus = a} :: GetCertificateAuthorityCsrResponse)++instance+  Prelude.NFData+    GetCertificateAuthorityCsrResponse+  where+  rnf GetCertificateAuthorityCsrResponse' {..} =+    Prelude.rnf csr+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,198 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.GetPolicy+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Retrieves the resource-based policy attached to a private CA. If either+-- the private CA resource or the policy cannot be found, this action+-- returns a @ResourceNotFoundException@.+--+-- The policy can be attached or updated with+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_PutPolicy.html PutPolicy>+-- and removed with+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePolicy.html DeletePolicy>.+--+-- __About Policies__+--+-- -   A policy grants access on a private CA to an Amazon Web Services+--     customer account, to Amazon Web Services Organizations, or to an+--     Amazon Web Services Organizations unit. Policies are under the+--     control of a CA administrator. For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html Using a Resource Based Policy with Amazon Web Services Private CA>.+--+-- -   A policy permits a user of Certificate Manager (ACM) to issue ACM+--     certificates signed by a CA in another account.+--+-- -   For ACM to manage automatic renewal of these certificates, the ACM+--     user must configure a Service Linked Role (SLR). The SLR allows the+--     ACM service to assume the identity of the user, subject to+--     confirmation against the Amazon Web Services Private CA policy. For+--     more information, see+--     <https://docs.aws.amazon.com/acm/latest/userguide/acm-slr.html Using a Service Linked Role with ACM>.+--+-- -   Updates made in Amazon Web Services Resource Manager (RAM) are+--     reflected in policies. For more information, see+--     <https://docs.aws.amazon.com/privateca/latest/userguide/pca-ram.html Attach a Policy for Cross-Account Access>.+module Amazonka.CertificateManagerPCA.GetPolicy+  ( -- * Creating a Request+    GetPolicy (..),+    newGetPolicy,++    -- * Request Lenses+    getPolicy_resourceArn,++    -- * Destructuring the Response+    GetPolicyResponse (..),+    newGetPolicyResponse,++    -- * Response Lenses+    getPolicyResponse_policy,+    getPolicyResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newGetPolicy' smart constructor.+data GetPolicy = GetPolicy'+  { -- | The Amazon Resource Number (ARN) of the private CA that will have its+    -- policy retrieved. You can find the CA\'s ARN by calling the+    -- ListCertificateAuthorities action.+    resourceArn :: Prelude.Text+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetPolicy' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'resourceArn', 'getPolicy_resourceArn' - The Amazon Resource Number (ARN) of the private CA that will have its+-- policy retrieved. You can find the CA\'s ARN by calling the+-- ListCertificateAuthorities action.+newGetPolicy ::+  -- | 'resourceArn'+  Prelude.Text ->+  GetPolicy+newGetPolicy pResourceArn_ =+  GetPolicy' {resourceArn = pResourceArn_}++-- | The Amazon Resource Number (ARN) of the private CA that will have its+-- policy retrieved. You can find the CA\'s ARN by calling the+-- ListCertificateAuthorities action.+getPolicy_resourceArn :: Lens.Lens' GetPolicy Prelude.Text+getPolicy_resourceArn = Lens.lens (\GetPolicy' {resourceArn} -> resourceArn) (\s@GetPolicy' {} a -> s {resourceArn = a} :: GetPolicy)++instance Core.AWSRequest GetPolicy where+  type AWSResponse GetPolicy = GetPolicyResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          GetPolicyResponse'+            Prelude.<$> (x Data..?> "Policy")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance Prelude.Hashable GetPolicy where+  hashWithSalt _salt GetPolicy' {..} =+    _salt `Prelude.hashWithSalt` resourceArn++instance Prelude.NFData GetPolicy where+  rnf GetPolicy' {..} = Prelude.rnf resourceArn++instance Data.ToHeaders GetPolicy where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ("ACMPrivateCA.GetPolicy" :: Prelude.ByteString),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON GetPolicy where+  toJSON GetPolicy' {..} =+    Data.object+      ( Prelude.catMaybes+          [Prelude.Just ("ResourceArn" Data..= resourceArn)]+      )++instance Data.ToPath GetPolicy where+  toPath = Prelude.const "/"++instance Data.ToQuery GetPolicy where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newGetPolicyResponse' smart constructor.+data GetPolicyResponse = GetPolicyResponse'+  { -- | The policy attached to the private CA as a JSON document.+    policy :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'GetPolicyResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'policy', 'getPolicyResponse_policy' - The policy attached to the private CA as a JSON document.+--+-- 'httpStatus', 'getPolicyResponse_httpStatus' - The response's http status code.+newGetPolicyResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  GetPolicyResponse+newGetPolicyResponse pHttpStatus_ =+  GetPolicyResponse'+    { policy = Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | The policy attached to the private CA as a JSON document.+getPolicyResponse_policy :: Lens.Lens' GetPolicyResponse (Prelude.Maybe Prelude.Text)+getPolicyResponse_policy = Lens.lens (\GetPolicyResponse' {policy} -> policy) (\s@GetPolicyResponse' {} a -> s {policy = a} :: GetPolicyResponse)++-- | The response's http status code.+getPolicyResponse_httpStatus :: Lens.Lens' GetPolicyResponse Prelude.Int+getPolicyResponse_httpStatus = Lens.lens (\GetPolicyResponse' {httpStatus} -> httpStatus) (\s@GetPolicyResponse' {} a -> s {httpStatus = a} :: GetPolicyResponse)++instance Prelude.NFData GetPolicyResponse where+  rnf GetPolicyResponse' {..} =+    Prelude.rnf policy+      `Prelude.seq` Prelude.rnf httpStatus

@@ -0,0 +1,353 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.ImportCertificateAuthorityCertificate+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Imports a signed private CA certificate into Amazon Web Services Private+-- CA. This action is used when you are using a chain of trust whose root+-- is located outside Amazon Web Services Private CA. Before you can call+-- this action, the following preparations must in place:+--+-- 1.  In Amazon Web Services Private CA, call the+--     <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>+--     action to create the private CA that you plan to back with the+--     imported certificate.+--+-- 2.  Call the+--     <https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCsr.html GetCertificateAuthorityCsr>+--     action to generate a certificate signing request (CSR).+--+-- 3.  Sign the CSR using a root or intermediate CA hosted by either an+--     on-premises PKI hierarchy or by a commercial CA.+--+-- 4.  Create a certificate chain and copy the signed certificate and the+--     certificate chain to your working directory.+--+-- Amazon Web Services Private CA supports three scenarios for installing a+-- CA certificate:+--+-- -   Installing a certificate for a root CA hosted by Amazon Web Services+--     Private CA.+--+-- -   Installing a subordinate CA certificate whose parent authority is+--     hosted by Amazon Web Services Private CA.+--+-- -   Installing a subordinate CA certificate whose parent authority is+--     externally hosted.+--+-- The following additional requirements apply when you import a CA+-- certificate.+--+-- -   Only a self-signed certificate can be imported as a root CA.+--+-- -   A self-signed certificate cannot be imported as a subordinate CA.+--+-- -   Your certificate chain must not include the private CA certificate+--     that you are importing.+--+-- -   Your root CA must be the last certificate in your chain. The+--     subordinate certificate, if any, that your root CA signed must be+--     next to last. The subordinate certificate signed by the preceding+--     subordinate CA must come next, and so on until your chain is built.+--+-- -   The chain must be PEM-encoded.+--+-- -   The maximum allowed size of a certificate is 32 KB.+--+-- -   The maximum allowed size of a certificate chain is 2 MB.+--+-- /Enforcement of Critical Constraints/+--+-- Amazon Web Services Private CA allows the following extensions to be+-- marked critical in the imported CA certificate or chain.+--+-- -   Basic constraints (/must/ be marked critical)+--+-- -   Subject alternative names+--+-- -   Key usage+--+-- -   Extended key usage+--+-- -   Authority key identifier+--+-- -   Subject key identifier+--+-- -   Issuer alternative name+--+-- -   Subject directory attributes+--+-- -   Subject information access+--+-- -   Certificate policies+--+-- -   Policy mappings+--+-- -   Inhibit anyPolicy+--+-- Amazon Web Services Private CA rejects the following extensions when+-- they are marked critical in an imported CA certificate or chain.+--+-- -   Name constraints+--+-- -   Policy constraints+--+-- -   CRL distribution points+--+-- -   Authority information access+--+-- -   Freshest CRL+--+-- -   Any other extension+module Amazonka.CertificateManagerPCA.ImportCertificateAuthorityCertificate+  ( -- * Creating a Request+    ImportCertificateAuthorityCertificate (..),+    newImportCertificateAuthorityCertificate,++    -- * Request Lenses+    importCertificateAuthorityCertificate_certificateChain,+    importCertificateAuthorityCertificate_certificateAuthorityArn,+    importCertificateAuthorityCertificate_certificate,++    -- * Destructuring the Response+    ImportCertificateAuthorityCertificateResponse (..),+    newImportCertificateAuthorityCertificateResponse,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newImportCertificateAuthorityCertificate' smart constructor.+data ImportCertificateAuthorityCertificate = ImportCertificateAuthorityCertificate'+  { -- | A PEM-encoded file that contains all of your certificates, other than+    -- the certificate you\'re importing, chaining up to your root CA. Your+    -- Amazon Web Services Private CA-hosted or on-premises root certificate is+    -- the last in the chain, and each certificate in the chain signs the one+    -- preceding.+    --+    -- This parameter must be supplied when you import a subordinate CA. When+    -- you import a root CA, there is no chain.+    certificateChain :: Prelude.Maybe Data.Base64,+    -- | The Amazon Resource Name (ARN) that was returned when you called+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+    -- This must be of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+    certificateAuthorityArn :: Prelude.Text,+    -- | The PEM-encoded certificate for a private CA. This may be a self-signed+    -- certificate in the case of a root CA, or it may be signed by another CA+    -- that you control.+    certificate :: Data.Base64+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'ImportCertificateAuthorityCertificate' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateChain', 'importCertificateAuthorityCertificate_certificateChain' - A PEM-encoded file that contains all of your certificates, other than+-- the certificate you\'re importing, chaining up to your root CA. Your+-- Amazon Web Services Private CA-hosted or on-premises root certificate is+-- the last in the chain, and each certificate in the chain signs the one+-- preceding.+--+-- This parameter must be supplied when you import a subordinate CA. When+-- you import a root CA, there is no chain.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+--+-- 'certificateAuthorityArn', 'importCertificateAuthorityCertificate_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+--+-- 'certificate', 'importCertificateAuthorityCertificate_certificate' - The PEM-encoded certificate for a private CA. This may be a self-signed+-- certificate in the case of a root CA, or it may be signed by another CA+-- that you control.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+newImportCertificateAuthorityCertificate ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'certificate'+  Prelude.ByteString ->+  ImportCertificateAuthorityCertificate+newImportCertificateAuthorityCertificate+  pCertificateAuthorityArn_+  pCertificate_ =+    ImportCertificateAuthorityCertificate'+      { certificateChain =+          Prelude.Nothing,+        certificateAuthorityArn =+          pCertificateAuthorityArn_,+        certificate =+          Data._Base64 Lens.# pCertificate_+      }++-- | A PEM-encoded file that contains all of your certificates, other than+-- the certificate you\'re importing, chaining up to your root CA. Your+-- Amazon Web Services Private CA-hosted or on-premises root certificate is+-- the last in the chain, and each certificate in the chain signs the one+-- preceding.+--+-- This parameter must be supplied when you import a subordinate CA. When+-- you import a root CA, there is no chain.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+importCertificateAuthorityCertificate_certificateChain :: Lens.Lens' ImportCertificateAuthorityCertificate (Prelude.Maybe Prelude.ByteString)+importCertificateAuthorityCertificate_certificateChain = Lens.lens (\ImportCertificateAuthorityCertificate' {certificateChain} -> certificateChain) (\s@ImportCertificateAuthorityCertificate' {} a -> s {certificateChain = a} :: ImportCertificateAuthorityCertificate) Prelude.. Lens.mapping Data._Base64++-- | The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+importCertificateAuthorityCertificate_certificateAuthorityArn :: Lens.Lens' ImportCertificateAuthorityCertificate Prelude.Text+importCertificateAuthorityCertificate_certificateAuthorityArn = Lens.lens (\ImportCertificateAuthorityCertificate' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@ImportCertificateAuthorityCertificate' {} a -> s {certificateAuthorityArn = a} :: ImportCertificateAuthorityCertificate)++-- | The PEM-encoded certificate for a private CA. This may be a self-signed+-- certificate in the case of a root CA, or it may be signed by another CA+-- that you control.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+importCertificateAuthorityCertificate_certificate :: Lens.Lens' ImportCertificateAuthorityCertificate Prelude.ByteString+importCertificateAuthorityCertificate_certificate = Lens.lens (\ImportCertificateAuthorityCertificate' {certificate} -> certificate) (\s@ImportCertificateAuthorityCertificate' {} a -> s {certificate = a} :: ImportCertificateAuthorityCertificate) Prelude.. Data._Base64++instance+  Core.AWSRequest+    ImportCertificateAuthorityCertificate+  where+  type+    AWSResponse+      ImportCertificateAuthorityCertificate =+      ImportCertificateAuthorityCertificateResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveNull+      ImportCertificateAuthorityCertificateResponse'++instance+  Prelude.Hashable+    ImportCertificateAuthorityCertificate+  where+  hashWithSalt+    _salt+    ImportCertificateAuthorityCertificate' {..} =+      _salt+        `Prelude.hashWithSalt` certificateChain+        `Prelude.hashWithSalt` certificateAuthorityArn+        `Prelude.hashWithSalt` certificate++instance+  Prelude.NFData+    ImportCertificateAuthorityCertificate+  where+  rnf ImportCertificateAuthorityCertificate' {..} =+    Prelude.rnf certificateChain+      `Prelude.seq` Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf certificate++instance+  Data.ToHeaders+    ImportCertificateAuthorityCertificate+  where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.ImportCertificateAuthorityCertificate" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance+  Data.ToJSON+    ImportCertificateAuthorityCertificate+  where+  toJSON ImportCertificateAuthorityCertificate' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("CertificateChain" Data..=)+              Prelude.<$> certificateChain,+            Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just ("Certificate" Data..= certificate)+          ]+      )++instance+  Data.ToPath+    ImportCertificateAuthorityCertificate+  where+  toPath = Prelude.const "/"++instance+  Data.ToQuery+    ImportCertificateAuthorityCertificate+  where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newImportCertificateAuthorityCertificateResponse' smart constructor.+data ImportCertificateAuthorityCertificateResponse = ImportCertificateAuthorityCertificateResponse'+  {+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'ImportCertificateAuthorityCertificateResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+newImportCertificateAuthorityCertificateResponse ::+  ImportCertificateAuthorityCertificateResponse+newImportCertificateAuthorityCertificateResponse =+  ImportCertificateAuthorityCertificateResponse'++instance+  Prelude.NFData+    ImportCertificateAuthorityCertificateResponse+  where+  rnf _ = ()

@@ -0,0 +1,571 @@+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DuplicateRecordFields #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE StrictData #-}+{-# LANGUAGE TypeFamilies #-}+{-# LANGUAGE NoImplicitPrelude #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Amazonka.CertificateManagerPCA.IssueCertificate+-- Copyright   : (c) 2013-2023 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Uses your private certificate authority (CA), or one that has been+-- shared with you, to issue a client certificate. This action returns the+-- Amazon Resource Name (ARN) of the certificate. You can retrieve the+-- certificate by calling the+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificate.html GetCertificate>+-- action and specifying the ARN.+--+-- You cannot use the ACM __ListCertificateAuthorities__ action to retrieve+-- the ARNs of the certificates that you issue by using Amazon Web Services+-- Private CA.+module Amazonka.CertificateManagerPCA.IssueCertificate+  ( -- * Creating a Request+    IssueCertificate (..),+    newIssueCertificate,++    -- * Request Lenses+    issueCertificate_apiPassthrough,+    issueCertificate_idempotencyToken,+    issueCertificate_templateArn,+    issueCertificate_validityNotBefore,+    issueCertificate_certificateAuthorityArn,+    issueCertificate_csr,+    issueCertificate_signingAlgorithm,+    issueCertificate_validity,++    -- * Destructuring the Response+    IssueCertificateResponse (..),+    newIssueCertificateResponse,++    -- * Response Lenses+    issueCertificateResponse_certificateArn,+    issueCertificateResponse_httpStatus,+  )+where++import Amazonka.CertificateManagerPCA.Types+import qualified Amazonka.Core as Core+import qualified Amazonka.Core.Lens.Internal as Lens+import qualified Amazonka.Data as Data+import qualified Amazonka.Prelude as Prelude+import qualified Amazonka.Request as Request+import qualified Amazonka.Response as Response++-- | /See:/ 'newIssueCertificate' smart constructor.+data IssueCertificate = IssueCertificate'+  { -- | Specifies X.509 certificate information to be included in the issued+    -- certificate. An @APIPassthrough@ or @APICSRPassthrough@ template variant+    -- must be selected, or else this parameter is ignored. For more+    -- information about using these templates, see+    -- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+    --+    -- If conflicting or duplicate certificate information is supplied during+    -- certificate issuance, Amazon Web Services Private CA applies+    -- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations order of operation rules>+    -- to determine what information is used.+    apiPassthrough :: Prelude.Maybe ApiPassthrough,+    -- | Alphanumeric string that can be used to distinguish between calls to the+    -- __IssueCertificate__ action. Idempotency tokens for __IssueCertificate__+    -- time out after one minute. Therefore, if you call __IssueCertificate__+    -- multiple times with the same idempotency token within one minute, Amazon+    -- Web Services Private CA recognizes that you are requesting only one+    -- certificate and will issue only one. If you change the idempotency token+    -- for each call, Amazon Web Services Private CA recognizes that you are+    -- requesting multiple certificates.+    idempotencyToken :: Prelude.Maybe Prelude.Text,+    -- | Specifies a custom configuration template to use when issuing a+    -- certificate. If this parameter is not provided, Amazon Web Services+    -- Private CA defaults to the @EndEntityCertificate\/V1@ template. For CA+    -- certificates, you should choose the shortest path length that meets your+    -- needs. The path length is indicated by the PathLen/N/ portion of the+    -- ARN, where /N/ is the+    -- <https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html#terms-cadepth CA depth>.+    --+    -- Note: The CA depth configured on a subordinate CA certificate must not+    -- exceed the limit set by its parents in the CA hierarchy.+    --+    -- For a list of @TemplateArn@ values supported by Amazon Web Services+    -- Private CA, see+    -- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+    templateArn :: Prelude.Maybe Prelude.Text,+    -- | Information describing the start of the validity period of the+    -- certificate. This parameter sets the “Not Before\" date for the+    -- certificate.+    --+    -- By default, when issuing a certificate, Amazon Web Services Private CA+    -- sets the \"Not Before\" date to the issuance time minus 60 minutes. This+    -- compensates for clock inconsistencies across computer systems. The+    -- @ValidityNotBefore@ parameter can be used to customize the “Not Before”+    -- value.+    --+    -- Unlike the @Validity@ parameter, the @ValidityNotBefore@ parameter is+    -- optional.+    --+    -- The @ValidityNotBefore@ value is expressed as an explicit date and time,+    -- using the @Validity@ type value @ABSOLUTE@. For more information, see+    -- <https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_Validity.html Validity>+    -- in this API reference and+    -- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+    -- in RFC 5280.+    validityNotBefore :: Prelude.Maybe Validity,+    -- | The Amazon Resource Name (ARN) that was returned when you called+    -- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+    -- This must be of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+    certificateAuthorityArn :: Prelude.Text,+    -- | The certificate signing request (CSR) for the certificate you want to+    -- issue. As an example, you can use the following OpenSSL command to+    -- create the CSR and a 2048 bit RSA private key.+    --+    -- @openssl req -new -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+    --+    -- If you have a configuration file, you can then use the following OpenSSL+    -- command. The @usr_cert@ block in the configuration file contains your+    -- X509 version 3 extensions.+    --+    -- @openssl req -new -config openssl_rsa.cnf -extensions usr_cert -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+    --+    -- Note: A CSR must provide either a /subject name/ or a /subject+    -- alternative name/ or the request will be rejected.+    csr :: Data.Base64,+    -- | The name of the algorithm that will be used to sign the certificate to+    -- be issued.+    --+    -- This parameter should not be confused with the @SigningAlgorithm@+    -- parameter used to sign a CSR in the @CreateCertificateAuthority@ action.+    --+    -- The specified signing algorithm family (RSA or ECDSA) much match the+    -- algorithm family of the CA\'s secret key.+    signingAlgorithm :: SigningAlgorithm,+    -- | Information describing the end of the validity period of the+    -- certificate. This parameter sets the “Not After” date for the+    -- certificate.+    --+    -- Certificate validity is the period of time during which a certificate is+    -- valid. Validity can be expressed as an explicit date and time when the+    -- certificate expires, or as a span of time after issuance, stated in+    -- days, months, or years. For more information, see+    -- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+    -- in RFC 5280.+    --+    -- This value is unaffected when @ValidityNotBefore@ is also specified. For+    -- example, if @Validity@ is set to 20 days in the future, the certificate+    -- will expire 20 days from issuance time regardless of the+    -- @ValidityNotBefore@ value.+    --+    -- The end of the validity period configured on a certificate must not+    -- exceed the limit set on its parents in the CA hierarchy.+    validity :: Validity+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'IssueCertificate' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'apiPassthrough', 'issueCertificate_apiPassthrough' - Specifies X.509 certificate information to be included in the issued+-- certificate. An @APIPassthrough@ or @APICSRPassthrough@ template variant+-- must be selected, or else this parameter is ignored. For more+-- information about using these templates, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+--+-- If conflicting or duplicate certificate information is supplied during+-- certificate issuance, Amazon Web Services Private CA applies+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations order of operation rules>+-- to determine what information is used.+--+-- 'idempotencyToken', 'issueCertificate_idempotencyToken' - Alphanumeric string that can be used to distinguish between calls to the+-- __IssueCertificate__ action. Idempotency tokens for __IssueCertificate__+-- time out after one minute. Therefore, if you call __IssueCertificate__+-- multiple times with the same idempotency token within one minute, Amazon+-- Web Services Private CA recognizes that you are requesting only one+-- certificate and will issue only one. If you change the idempotency token+-- for each call, Amazon Web Services Private CA recognizes that you are+-- requesting multiple certificates.+--+-- 'templateArn', 'issueCertificate_templateArn' - Specifies a custom configuration template to use when issuing a+-- certificate. If this parameter is not provided, Amazon Web Services+-- Private CA defaults to the @EndEntityCertificate\/V1@ template. For CA+-- certificates, you should choose the shortest path length that meets your+-- needs. The path length is indicated by the PathLen/N/ portion of the+-- ARN, where /N/ is the+-- <https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html#terms-cadepth CA depth>.+--+-- Note: The CA depth configured on a subordinate CA certificate must not+-- exceed the limit set by its parents in the CA hierarchy.+--+-- For a list of @TemplateArn@ values supported by Amazon Web Services+-- Private CA, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+--+-- 'validityNotBefore', 'issueCertificate_validityNotBefore' - Information describing the start of the validity period of the+-- certificate. This parameter sets the “Not Before\" date for the+-- certificate.+--+-- By default, when issuing a certificate, Amazon Web Services Private CA+-- sets the \"Not Before\" date to the issuance time minus 60 minutes. This+-- compensates for clock inconsistencies across computer systems. The+-- @ValidityNotBefore@ parameter can be used to customize the “Not Before”+-- value.+--+-- Unlike the @Validity@ parameter, the @ValidityNotBefore@ parameter is+-- optional.+--+-- The @ValidityNotBefore@ value is expressed as an explicit date and time,+-- using the @Validity@ type value @ABSOLUTE@. For more information, see+-- <https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_Validity.html Validity>+-- in this API reference and+-- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+-- in RFC 5280.+--+-- 'certificateAuthorityArn', 'issueCertificate_certificateAuthorityArn' - The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+--+-- 'csr', 'issueCertificate_csr' - The certificate signing request (CSR) for the certificate you want to+-- issue. As an example, you can use the following OpenSSL command to+-- create the CSR and a 2048 bit RSA private key.+--+-- @openssl req -new -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+--+-- If you have a configuration file, you can then use the following OpenSSL+-- command. The @usr_cert@ block in the configuration file contains your+-- X509 version 3 extensions.+--+-- @openssl req -new -config openssl_rsa.cnf -extensions usr_cert -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+--+-- Note: A CSR must provide either a /subject name/ or a /subject+-- alternative name/ or the request will be rejected.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+--+-- 'signingAlgorithm', 'issueCertificate_signingAlgorithm' - The name of the algorithm that will be used to sign the certificate to+-- be issued.+--+-- This parameter should not be confused with the @SigningAlgorithm@+-- parameter used to sign a CSR in the @CreateCertificateAuthority@ action.+--+-- The specified signing algorithm family (RSA or ECDSA) much match the+-- algorithm family of the CA\'s secret key.+--+-- 'validity', 'issueCertificate_validity' - Information describing the end of the validity period of the+-- certificate. This parameter sets the “Not After” date for the+-- certificate.+--+-- Certificate validity is the period of time during which a certificate is+-- valid. Validity can be expressed as an explicit date and time when the+-- certificate expires, or as a span of time after issuance, stated in+-- days, months, or years. For more information, see+-- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+-- in RFC 5280.+--+-- This value is unaffected when @ValidityNotBefore@ is also specified. For+-- example, if @Validity@ is set to 20 days in the future, the certificate+-- will expire 20 days from issuance time regardless of the+-- @ValidityNotBefore@ value.+--+-- The end of the validity period configured on a certificate must not+-- exceed the limit set on its parents in the CA hierarchy.+newIssueCertificate ::+  -- | 'certificateAuthorityArn'+  Prelude.Text ->+  -- | 'csr'+  Prelude.ByteString ->+  -- | 'signingAlgorithm'+  SigningAlgorithm ->+  -- | 'validity'+  Validity ->+  IssueCertificate+newIssueCertificate+  pCertificateAuthorityArn_+  pCsr_+  pSigningAlgorithm_+  pValidity_ =+    IssueCertificate'+      { apiPassthrough = Prelude.Nothing,+        idempotencyToken = Prelude.Nothing,+        templateArn = Prelude.Nothing,+        validityNotBefore = Prelude.Nothing,+        certificateAuthorityArn = pCertificateAuthorityArn_,+        csr = Data._Base64 Lens.# pCsr_,+        signingAlgorithm = pSigningAlgorithm_,+        validity = pValidity_+      }++-- | Specifies X.509 certificate information to be included in the issued+-- certificate. An @APIPassthrough@ or @APICSRPassthrough@ template variant+-- must be selected, or else this parameter is ignored. For more+-- information about using these templates, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+--+-- If conflicting or duplicate certificate information is supplied during+-- certificate issuance, Amazon Web Services Private CA applies+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations order of operation rules>+-- to determine what information is used.+issueCertificate_apiPassthrough :: Lens.Lens' IssueCertificate (Prelude.Maybe ApiPassthrough)+issueCertificate_apiPassthrough = Lens.lens (\IssueCertificate' {apiPassthrough} -> apiPassthrough) (\s@IssueCertificate' {} a -> s {apiPassthrough = a} :: IssueCertificate)++-- | Alphanumeric string that can be used to distinguish between calls to the+-- __IssueCertificate__ action. Idempotency tokens for __IssueCertificate__+-- time out after one minute. Therefore, if you call __IssueCertificate__+-- multiple times with the same idempotency token within one minute, Amazon+-- Web Services Private CA recognizes that you are requesting only one+-- certificate and will issue only one. If you change the idempotency token+-- for each call, Amazon Web Services Private CA recognizes that you are+-- requesting multiple certificates.+issueCertificate_idempotencyToken :: Lens.Lens' IssueCertificate (Prelude.Maybe Prelude.Text)+issueCertificate_idempotencyToken = Lens.lens (\IssueCertificate' {idempotencyToken} -> idempotencyToken) (\s@IssueCertificate' {} a -> s {idempotencyToken = a} :: IssueCertificate)++-- | Specifies a custom configuration template to use when issuing a+-- certificate. If this parameter is not provided, Amazon Web Services+-- Private CA defaults to the @EndEntityCertificate\/V1@ template. For CA+-- certificates, you should choose the shortest path length that meets your+-- needs. The path length is indicated by the PathLen/N/ portion of the+-- ARN, where /N/ is the+-- <https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html#terms-cadepth CA depth>.+--+-- Note: The CA depth configured on a subordinate CA certificate must not+-- exceed the limit set by its parents in the CA hierarchy.+--+-- For a list of @TemplateArn@ values supported by Amazon Web Services+-- Private CA, see+-- <https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html Understanding Certificate Templates>.+issueCertificate_templateArn :: Lens.Lens' IssueCertificate (Prelude.Maybe Prelude.Text)+issueCertificate_templateArn = Lens.lens (\IssueCertificate' {templateArn} -> templateArn) (\s@IssueCertificate' {} a -> s {templateArn = a} :: IssueCertificate)++-- | Information describing the start of the validity period of the+-- certificate. This parameter sets the “Not Before\" date for the+-- certificate.+--+-- By default, when issuing a certificate, Amazon Web Services Private CA+-- sets the \"Not Before\" date to the issuance time minus 60 minutes. This+-- compensates for clock inconsistencies across computer systems. The+-- @ValidityNotBefore@ parameter can be used to customize the “Not Before”+-- value.+--+-- Unlike the @Validity@ parameter, the @ValidityNotBefore@ parameter is+-- optional.+--+-- The @ValidityNotBefore@ value is expressed as an explicit date and time,+-- using the @Validity@ type value @ABSOLUTE@. For more information, see+-- <https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_Validity.html Validity>+-- in this API reference and+-- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+-- in RFC 5280.+issueCertificate_validityNotBefore :: Lens.Lens' IssueCertificate (Prelude.Maybe Validity)+issueCertificate_validityNotBefore = Lens.lens (\IssueCertificate' {validityNotBefore} -> validityNotBefore) (\s@IssueCertificate' {} a -> s {validityNotBefore = a} :: IssueCertificate)++-- | The Amazon Resource Name (ARN) that was returned when you called+-- <https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html CreateCertificateAuthority>.+-- This must be of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@ @+issueCertificate_certificateAuthorityArn :: Lens.Lens' IssueCertificate Prelude.Text+issueCertificate_certificateAuthorityArn = Lens.lens (\IssueCertificate' {certificateAuthorityArn} -> certificateAuthorityArn) (\s@IssueCertificate' {} a -> s {certificateAuthorityArn = a} :: IssueCertificate)++-- | The certificate signing request (CSR) for the certificate you want to+-- issue. As an example, you can use the following OpenSSL command to+-- create the CSR and a 2048 bit RSA private key.+--+-- @openssl req -new -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+--+-- If you have a configuration file, you can then use the following OpenSSL+-- command. The @usr_cert@ block in the configuration file contains your+-- X509 version 3 extensions.+--+-- @openssl req -new -config openssl_rsa.cnf -extensions usr_cert -newkey rsa:2048 -days 365 -keyout private\/test_cert_priv_key.pem -out csr\/test_cert_.csr@+--+-- Note: A CSR must provide either a /subject name/ or a /subject+-- alternative name/ or the request will be rejected.--+-- -- /Note:/ This 'Lens' automatically encodes and decodes Base64 data.+-- -- The underlying isomorphism will encode to Base64 representation during+-- -- serialisation, and decode from Base64 representation during deserialisation.+-- -- This 'Lens' accepts and returns only raw unencoded data.+issueCertificate_csr :: Lens.Lens' IssueCertificate Prelude.ByteString+issueCertificate_csr = Lens.lens (\IssueCertificate' {csr} -> csr) (\s@IssueCertificate' {} a -> s {csr = a} :: IssueCertificate) Prelude.. Data._Base64++-- | The name of the algorithm that will be used to sign the certificate to+-- be issued.+--+-- This parameter should not be confused with the @SigningAlgorithm@+-- parameter used to sign a CSR in the @CreateCertificateAuthority@ action.+--+-- The specified signing algorithm family (RSA or ECDSA) much match the+-- algorithm family of the CA\'s secret key.+issueCertificate_signingAlgorithm :: Lens.Lens' IssueCertificate SigningAlgorithm+issueCertificate_signingAlgorithm = Lens.lens (\IssueCertificate' {signingAlgorithm} -> signingAlgorithm) (\s@IssueCertificate' {} a -> s {signingAlgorithm = a} :: IssueCertificate)++-- | Information describing the end of the validity period of the+-- certificate. This parameter sets the “Not After” date for the+-- certificate.+--+-- Certificate validity is the period of time during which a certificate is+-- valid. Validity can be expressed as an explicit date and time when the+-- certificate expires, or as a span of time after issuance, stated in+-- days, months, or years. For more information, see+-- <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5 Validity>+-- in RFC 5280.+--+-- This value is unaffected when @ValidityNotBefore@ is also specified. For+-- example, if @Validity@ is set to 20 days in the future, the certificate+-- will expire 20 days from issuance time regardless of the+-- @ValidityNotBefore@ value.+--+-- The end of the validity period configured on a certificate must not+-- exceed the limit set on its parents in the CA hierarchy.+issueCertificate_validity :: Lens.Lens' IssueCertificate Validity+issueCertificate_validity = Lens.lens (\IssueCertificate' {validity} -> validity) (\s@IssueCertificate' {} a -> s {validity = a} :: IssueCertificate)++instance Core.AWSRequest IssueCertificate where+  type+    AWSResponse IssueCertificate =+      IssueCertificateResponse+  request overrides =+    Request.postJSON (overrides defaultService)+  response =+    Response.receiveJSON+      ( \s h x ->+          IssueCertificateResponse'+            Prelude.<$> (x Data..?> "CertificateArn")+            Prelude.<*> (Prelude.pure (Prelude.fromEnum s))+      )++instance Prelude.Hashable IssueCertificate where+  hashWithSalt _salt IssueCertificate' {..} =+    _salt+      `Prelude.hashWithSalt` apiPassthrough+      `Prelude.hashWithSalt` idempotencyToken+      `Prelude.hashWithSalt` templateArn+      `Prelude.hashWithSalt` validityNotBefore+      `Prelude.hashWithSalt` certificateAuthorityArn+      `Prelude.hashWithSalt` csr+      `Prelude.hashWithSalt` signingAlgorithm+      `Prelude.hashWithSalt` validity++instance Prelude.NFData IssueCertificate where+  rnf IssueCertificate' {..} =+    Prelude.rnf apiPassthrough+      `Prelude.seq` Prelude.rnf idempotencyToken+      `Prelude.seq` Prelude.rnf templateArn+      `Prelude.seq` Prelude.rnf validityNotBefore+      `Prelude.seq` Prelude.rnf certificateAuthorityArn+      `Prelude.seq` Prelude.rnf csr+      `Prelude.seq` Prelude.rnf signingAlgorithm+      `Prelude.seq` Prelude.rnf validity++instance Data.ToHeaders IssueCertificate where+  toHeaders =+    Prelude.const+      ( Prelude.mconcat+          [ "X-Amz-Target"+              Data.=# ( "ACMPrivateCA.IssueCertificate" ::+                          Prelude.ByteString+                      ),+            "Content-Type"+              Data.=# ( "application/x-amz-json-1.1" ::+                          Prelude.ByteString+                      )+          ]+      )++instance Data.ToJSON IssueCertificate where+  toJSON IssueCertificate' {..} =+    Data.object+      ( Prelude.catMaybes+          [ ("ApiPassthrough" Data..=)+              Prelude.<$> apiPassthrough,+            ("IdempotencyToken" Data..=)+              Prelude.<$> idempotencyToken,+            ("TemplateArn" Data..=) Prelude.<$> templateArn,+            ("ValidityNotBefore" Data..=)+              Prelude.<$> validityNotBefore,+            Prelude.Just+              ( "CertificateAuthorityArn"+                  Data..= certificateAuthorityArn+              ),+            Prelude.Just ("Csr" Data..= csr),+            Prelude.Just+              ("SigningAlgorithm" Data..= signingAlgorithm),+            Prelude.Just ("Validity" Data..= validity)+          ]+      )++instance Data.ToPath IssueCertificate where+  toPath = Prelude.const "/"++instance Data.ToQuery IssueCertificate where+  toQuery = Prelude.const Prelude.mempty++-- | /See:/ 'newIssueCertificateResponse' smart constructor.+data IssueCertificateResponse = IssueCertificateResponse'+  { -- | The Amazon Resource Name (ARN) of the issued certificate and the+    -- certificate serial number. This is of the form:+    --+    -- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+    certificateArn :: Prelude.Maybe Prelude.Text,+    -- | The response's http status code.+    httpStatus :: Prelude.Int+  }+  deriving (Prelude.Eq, Prelude.Read, Prelude.Show, Prelude.Generic)++-- |+-- Create a value of 'IssueCertificateResponse' with all optional fields omitted.+--+-- Use <https://hackage.haskell.org/package/generic-lens generic-lens> or <https://hackage.haskell.org/package/optics optics> to modify other optional fields.+--+-- The following record fields are available, with the corresponding lenses provided+-- for backwards compatibility:+--+-- 'certificateArn', 'issueCertificateResponse_certificateArn' - The Amazon Resource Name (ARN) of the issued certificate and the+-- certificate serial number. This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+--+-- 'httpStatus', 'issueCertificateResponse_httpStatus' - The response's http status code.+newIssueCertificateResponse ::+  -- | 'httpStatus'+  Prelude.Int ->+  IssueCertificateResponse+newIssueCertificateResponse pHttpStatus_ =+  IssueCertificateResponse'+    { certificateArn =+        Prelude.Nothing,+      httpStatus = pHttpStatus_+    }++-- | The Amazon Resource Name (ARN) of the issued certificate and the+-- certificate serial number. This is of the form:+--+-- @arn:aws:acm-pca:@/@region@/@:@/@account@/@:certificate-authority\/@/@12345678-1234-1234-1234-123456789012@/@\/certificate\/@/@286535153982981100925020015808220737245@/@ @+issueCertificateResponse_certificateArn :: Lens.Lens' IssueCertificateResponse (Prelude.Maybe Prelude.Text)+issueCertificateResponse_certificateArn = Lens.lens (\IssueCertificateResponse' {certificateArn} -> certificateArn) (\s@IssueCertificateResponse' {} a -> s {certificateArn = a} :: IssueCertificateResponse)++-- | The response's http status code.+issueCertificateResponse_httpStatus :: Lens.Lens' IssueCertificateResponse Prelude.Int+issueCertificateResponse_httpStatus = Lens.lens (\IssueCertificateResponse' {httpStatus} -> httpStatus) (\s@IssueCertificateResponse' {} a -> s {httpStatus = a} :: IssueCertificateResponse)++instance Prelude.NFData IssueCertificateResponse where+  rnf IssueCertificateResponse' {..} =+    Prelude.rnf certificateArn+      `Prelude.seq` Prelude.rnf httpStatus