AWS Private CA now supports customer managed permissions in AWS Resource Access Manager (RAM), empowering administrators to specify granular API operation access for shared certificate authorities across accounts. This replaces the prior all-or-nothing AWS managed permission model, improving security and flexibility.
Administrators can choose from read and write operations, lift restrictions on certificate templates for cross-account issuers, and assign permissions per consuming account or organizational unit. This feature is available in all AWS regions supporting Private CA and RAM, supporting tailored PKI governance in multi-account environments.
Source & further reading
AWS Private CA now supports customer managed permissions for cross-account sharing ↗Source published 2026-04-09. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.