aws-sdk-acmpca 1.31.0 → 1.36.0

data/lib/aws-sdk-acmpca/client_api.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 
@@ -23,6 +23,7 @@ module Aws::ACMPCA
     AccountId = Shapes::StringShape.new(name: 'AccountId')
     ActionList = Shapes::ListShape.new(name: 'ActionList')
     ActionType = Shapes::StringShape.new(name: 'ActionType')
+    ApiPassthrough = Shapes::StructureShape.new(name: 'ApiPassthrough')
     Arn = Shapes::StringShape.new(name: 'Arn')
     AuditReportId = Shapes::StringShape.new(name: 'AuditReportId')
     AuditReportResponseFormat = Shapes::StringShape.new(name: 'AuditReportResponseFormat')
@@ -38,6 +39,7 @@ module Aws::ACMPCA
     CertificateChain = Shapes::StringShape.new(name: 'CertificateChain')
     CertificateChainBlob = Shapes::BlobShape.new(name: 'CertificateChainBlob')
     CertificateMismatchException = Shapes::StructureShape.new(name: 'CertificateMismatchException')
+    CertificatePolicyList = Shapes::ListShape.new(name: 'CertificatePolicyList')
     ConcurrentModificationException = Shapes::StructureShape.new(name: 'ConcurrentModificationException')
     CountryCodeString = Shapes::StringShape.new(name: 'CountryCodeString')
     CreateCertificateAuthorityAuditReportRequest = Shapes::StructureShape.new(name: 'CreateCertificateAuthorityAuditReportRequest')
@@ -58,8 +60,13 @@ module Aws::ACMPCA
     DescribeCertificateAuthorityRequest = Shapes::StructureShape.new(name: 'DescribeCertificateAuthorityRequest')
     DescribeCertificateAuthorityResponse = Shapes::StructureShape.new(name: 'DescribeCertificateAuthorityResponse')
     EdiPartyName = Shapes::StructureShape.new(name: 'EdiPartyName')
+    ExtendedKeyUsage = Shapes::StructureShape.new(name: 'ExtendedKeyUsage')
+    ExtendedKeyUsageList = Shapes::ListShape.new(name: 'ExtendedKeyUsageList')
+    ExtendedKeyUsageType = Shapes::StringShape.new(name: 'ExtendedKeyUsageType')
+    Extensions = Shapes::StructureShape.new(name: 'Extensions')
     FailureReason = Shapes::StringShape.new(name: 'FailureReason')
     GeneralName = Shapes::StructureShape.new(name: 'GeneralName')
+    GeneralNameList = Shapes::ListShape.new(name: 'GeneralNameList')
     GetCertificateAuthorityCertificateRequest = Shapes::StructureShape.new(name: 'GetCertificateAuthorityCertificateRequest')
     GetCertificateAuthorityCertificateResponse = Shapes::StructureShape.new(name: 'GetCertificateAuthorityCertificateResponse')
     GetCertificateAuthorityCsrRequest = Shapes::StructureShape.new(name: 'GetCertificateAuthorityCsrRequest')
@@ -81,6 +88,7 @@ module Aws::ACMPCA
     IssueCertificateRequest = Shapes::StructureShape.new(name: 'IssueCertificateRequest')
     IssueCertificateResponse = Shapes::StructureShape.new(name: 'IssueCertificateResponse')
     KeyAlgorithm = Shapes::StringShape.new(name: 'KeyAlgorithm')
+    KeyStorageSecurityStandard = Shapes::StringShape.new(name: 'KeyStorageSecurityStandard')
     KeyUsage = Shapes::StructureShape.new(name: 'KeyUsage')
     LimitExceededException = Shapes::StructureShape.new(name: 'LimitExceededException')
     ListCertificateAuthoritiesRequest = Shapes::StructureShape.new(name: 'ListCertificateAuthoritiesRequest')
@@ -99,9 +107,14 @@ module Aws::ACMPCA
     Permission = Shapes::StructureShape.new(name: 'Permission')
     PermissionAlreadyExistsException = Shapes::StructureShape.new(name: 'PermissionAlreadyExistsException')
     PermissionList = Shapes::ListShape.new(name: 'PermissionList')
+    PolicyInformation = Shapes::StructureShape.new(name: 'PolicyInformation')
+    PolicyQualifierId = Shapes::StringShape.new(name: 'PolicyQualifierId')
+    PolicyQualifierInfo = Shapes::StructureShape.new(name: 'PolicyQualifierInfo')
+    PolicyQualifierInfoList = Shapes::ListShape.new(name: 'PolicyQualifierInfoList')
     PositiveLong = Shapes::IntegerShape.new(name: 'PositiveLong')
     Principal = Shapes::StringShape.new(name: 'Principal')
     PutPolicyRequest = Shapes::StructureShape.new(name: 'PutPolicyRequest')
+    Qualifier = Shapes::StructureShape.new(name: 'Qualifier')
     RequestAlreadyProcessedException = Shapes::StructureShape.new(name: 'RequestAlreadyProcessedException')
     RequestFailedException = Shapes::StructureShape.new(name: 'RequestFailedException')
     RequestInProgressException = Shapes::StructureShape.new(name: 'RequestInProgressException')
@@ -113,6 +126,7 @@ module Aws::ACMPCA
     RevokeCertificateRequest = Shapes::StructureShape.new(name: 'RevokeCertificateRequest')
     S3BucketName = Shapes::StringShape.new(name: 'S3BucketName')
     S3Key = Shapes::StringShape.new(name: 'S3Key')
+    S3ObjectAcl = Shapes::StringShape.new(name: 'S3ObjectAcl')
     SigningAlgorithm = Shapes::StringShape.new(name: 'SigningAlgorithm')
     String = Shapes::StringShape.new(name: 'String')
     String128 = Shapes::StringShape.new(name: 'String128')
@@ -165,6 +179,10 @@ module Aws::ACMPCA
 
     ActionList.member = Shapes::ShapeRef.new(shape: ActionType)
 
+    ApiPassthrough.add_member(:extensions, Shapes::ShapeRef.new(shape: Extensions, location_name: "Extensions"))
+    ApiPassthrough.add_member(:subject, Shapes::ShapeRef.new(shape: ASN1Subject, location_name: "Subject"))
+    ApiPassthrough.struct_class = Types::ApiPassthrough
+
     CertificateAuthorities.member = Shapes::ShapeRef.new(shape: CertificateAuthority)
 
     CertificateAuthority.add_member(:arn, Shapes::ShapeRef.new(shape: Arn, location_name: "Arn"))
@@ -180,6 +198,7 @@ module Aws::ACMPCA
     CertificateAuthority.add_member(:certificate_authority_configuration, Shapes::ShapeRef.new(shape: CertificateAuthorityConfiguration, location_name: "CertificateAuthorityConfiguration"))
     CertificateAuthority.add_member(:revocation_configuration, Shapes::ShapeRef.new(shape: RevocationConfiguration, location_name: "RevocationConfiguration"))
     CertificateAuthority.add_member(:restorable_until, Shapes::ShapeRef.new(shape: TStamp, location_name: "RestorableUntil"))
+    CertificateAuthority.add_member(:key_storage_security_standard, Shapes::ShapeRef.new(shape: KeyStorageSecurityStandard, location_name: "KeyStorageSecurityStandard"))
     CertificateAuthority.struct_class = Types::CertificateAuthority
 
     CertificateAuthorityConfiguration.add_member(:key_algorithm, Shapes::ShapeRef.new(shape: KeyAlgorithm, required: true, location_name: "KeyAlgorithm"))
@@ -191,6 +210,8 @@ module Aws::ACMPCA
     CertificateMismatchException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     CertificateMismatchException.struct_class = Types::CertificateMismatchException
 
+    CertificatePolicyList.member = Shapes::ShapeRef.new(shape: PolicyInformation)
+
     ConcurrentModificationException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     ConcurrentModificationException.struct_class = Types::ConcurrentModificationException
 
@@ -207,6 +228,7 @@ module Aws::ACMPCA
     CreateCertificateAuthorityRequest.add_member(:revocation_configuration, Shapes::ShapeRef.new(shape: RevocationConfiguration, location_name: "RevocationConfiguration"))
     CreateCertificateAuthorityRequest.add_member(:certificate_authority_type, Shapes::ShapeRef.new(shape: CertificateAuthorityType, required: true, location_name: "CertificateAuthorityType"))
     CreateCertificateAuthorityRequest.add_member(:idempotency_token, Shapes::ShapeRef.new(shape: IdempotencyToken, location_name: "IdempotencyToken"))
+    CreateCertificateAuthorityRequest.add_member(:key_storage_security_standard, Shapes::ShapeRef.new(shape: KeyStorageSecurityStandard, location_name: "KeyStorageSecurityStandard"))
     CreateCertificateAuthorityRequest.add_member(:tags, Shapes::ShapeRef.new(shape: TagList, location_name: "Tags"))
     CreateCertificateAuthorityRequest.struct_class = Types::CreateCertificateAuthorityRequest
 
@@ -223,6 +245,7 @@ module Aws::ACMPCA
     CrlConfiguration.add_member(:expiration_in_days, Shapes::ShapeRef.new(shape: Integer1To5000, location_name: "ExpirationInDays", metadata: {"box"=>true}))
     CrlConfiguration.add_member(:custom_cname, Shapes::ShapeRef.new(shape: String253, location_name: "CustomCname"))
     CrlConfiguration.add_member(:s3_bucket_name, Shapes::ShapeRef.new(shape: String3To255, location_name: "S3BucketName"))
+    CrlConfiguration.add_member(:s3_object_acl, Shapes::ShapeRef.new(shape: S3ObjectAcl, location_name: "S3ObjectAcl"))
     CrlConfiguration.struct_class = Types::CrlConfiguration
 
     CsrExtensions.add_member(:key_usage, Shapes::ShapeRef.new(shape: KeyUsage, location_name: "KeyUsage"))
@@ -261,6 +284,18 @@ module Aws::ACMPCA
     EdiPartyName.add_member(:name_assigner, Shapes::ShapeRef.new(shape: String256, location_name: "NameAssigner"))
     EdiPartyName.struct_class = Types::EdiPartyName
 
+    ExtendedKeyUsage.add_member(:extended_key_usage_type, Shapes::ShapeRef.new(shape: ExtendedKeyUsageType, location_name: "ExtendedKeyUsageType"))
+    ExtendedKeyUsage.add_member(:extended_key_usage_object_identifier, Shapes::ShapeRef.new(shape: CustomObjectIdentifier, location_name: "ExtendedKeyUsageObjectIdentifier"))
+    ExtendedKeyUsage.struct_class = Types::ExtendedKeyUsage
+
+    ExtendedKeyUsageList.member = Shapes::ShapeRef.new(shape: ExtendedKeyUsage)
+
+    Extensions.add_member(:certificate_policies, Shapes::ShapeRef.new(shape: CertificatePolicyList, location_name: "CertificatePolicies"))
+    Extensions.add_member(:extended_key_usage, Shapes::ShapeRef.new(shape: ExtendedKeyUsageList, location_name: "ExtendedKeyUsage"))
+    Extensions.add_member(:key_usage, Shapes::ShapeRef.new(shape: KeyUsage, location_name: "KeyUsage"))
+    Extensions.add_member(:subject_alternative_names, Shapes::ShapeRef.new(shape: GeneralNameList, location_name: "SubjectAlternativeNames"))
+    Extensions.struct_class = Types::Extensions
+
     GeneralName.add_member(:other_name, Shapes::ShapeRef.new(shape: OtherName, location_name: "OtherName"))
     GeneralName.add_member(:rfc_822_name, Shapes::ShapeRef.new(shape: String256, location_name: "Rfc822Name"))
     GeneralName.add_member(:dns_name, Shapes::ShapeRef.new(shape: String253, location_name: "DnsName"))
@@ -271,6 +306,8 @@ module Aws::ACMPCA
     GeneralName.add_member(:registered_id, Shapes::ShapeRef.new(shape: CustomObjectIdentifier, location_name: "RegisteredId"))
     GeneralName.struct_class = Types::GeneralName
 
+    GeneralNameList.member = Shapes::ShapeRef.new(shape: GeneralName)
+
     GetCertificateAuthorityCertificateRequest.add_member(:certificate_authority_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "CertificateAuthorityArn"))
     GetCertificateAuthorityCertificateRequest.struct_class = Types::GetCertificateAuthorityCertificateRequest
 
@@ -324,11 +361,13 @@ module Aws::ACMPCA
     InvalidTagException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     InvalidTagException.struct_class = Types::InvalidTagException
 
+    IssueCertificateRequest.add_member(:api_passthrough, Shapes::ShapeRef.new(shape: ApiPassthrough, location_name: "ApiPassthrough"))
     IssueCertificateRequest.add_member(:certificate_authority_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "CertificateAuthorityArn"))
     IssueCertificateRequest.add_member(:csr, Shapes::ShapeRef.new(shape: CsrBlob, required: true, location_name: "Csr"))
     IssueCertificateRequest.add_member(:signing_algorithm, Shapes::ShapeRef.new(shape: SigningAlgorithm, required: true, location_name: "SigningAlgorithm"))
     IssueCertificateRequest.add_member(:template_arn, Shapes::ShapeRef.new(shape: Arn, location_name: "TemplateArn"))
     IssueCertificateRequest.add_member(:validity, Shapes::ShapeRef.new(shape: Validity, required: true, location_name: "Validity"))
+    IssueCertificateRequest.add_member(:validity_not_before, Shapes::ShapeRef.new(shape: Validity, location_name: "ValidityNotBefore"))
     IssueCertificateRequest.add_member(:idempotency_token, Shapes::ShapeRef.new(shape: IdempotencyToken, location_name: "IdempotencyToken"))
     IssueCertificateRequest.struct_class = Types::IssueCertificateRequest
 
@@ -402,10 +441,23 @@ module Aws::ACMPCA
 
     PermissionList.member = Shapes::ShapeRef.new(shape: Permission)
 
+    PolicyInformation.add_member(:cert_policy_id, Shapes::ShapeRef.new(shape: CustomObjectIdentifier, required: true, location_name: "CertPolicyId"))
+    PolicyInformation.add_member(:policy_qualifiers, Shapes::ShapeRef.new(shape: PolicyQualifierInfoList, location_name: "PolicyQualifiers"))
+    PolicyInformation.struct_class = Types::PolicyInformation
+
+    PolicyQualifierInfo.add_member(:policy_qualifier_id, Shapes::ShapeRef.new(shape: PolicyQualifierId, required: true, location_name: "PolicyQualifierId"))
+    PolicyQualifierInfo.add_member(:qualifier, Shapes::ShapeRef.new(shape: Qualifier, required: true, location_name: "Qualifier"))
+    PolicyQualifierInfo.struct_class = Types::PolicyQualifierInfo
+
+    PolicyQualifierInfoList.member = Shapes::ShapeRef.new(shape: PolicyQualifierInfo)
+
     PutPolicyRequest.add_member(:resource_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "ResourceArn"))
     PutPolicyRequest.add_member(:policy, Shapes::ShapeRef.new(shape: AWSPolicy, required: true, location_name: "Policy"))
     PutPolicyRequest.struct_class = Types::PutPolicyRequest
 
+    Qualifier.add_member(:cps_uri, Shapes::ShapeRef.new(shape: String256, required: true, location_name: "CpsUri"))
+    Qualifier.struct_class = Types::Qualifier
+
     RequestAlreadyProcessedException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     RequestAlreadyProcessedException.struct_class = Types::RequestAlreadyProcessedException
 

data/lib/aws-sdk-acmpca/errors.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-acmpca/resource.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-acmpca/types.rb

@@ -3,23 +3,19 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 
 module Aws::ACMPCA
   module Types
 
-    # Contains information about the certificate subject. The certificate
-    # can be one issued by your private certificate authority (CA) or it can
-    # be your private CA certificate. The **Subject** field in the
-    # certificate identifies the entity that owns or controls the public key
-    # in the certificate. The entity can be a user, computer, device, or
-    # service. The **Subject** must contain an X.500 distinguished name
-    # (DN). A DN is a sequence of relative distinguished names (RDNs). The
-    # RDNs are separated by commas in the certificate. The DN must be unique
-    # for each entity, but your private CA can issue more than one
-    # certificate with the same DN to the same entity.
+    # Contains information about the certificate subject. The `Subject`
+    # field in the certificate identifies the entity that owns or controls
+    # the public key in the certificate. The entity can be a user, computer,
+    # device, or service. The `Subject `must contain an X.500 distinguished
+    # name (DN). A DN is a sequence of relative distinguished names (RDNs).
+    # The RDNs are separated by commas in the certificate.
     #
     # @note When making an API call, you may pass ASN1Subject
     #   data as a hash:
@@ -100,7 +96,7 @@ module Aws::ACMPCA
     # @!attribute [rw] initials
     #   Concatenation that typically contains the first letter of the
     #   **GivenName**, the first letter of the middle name if one exists,
-    #   and the first letter of the **SurName**.
+    #   and the first letter of the **Surname**.
     #   @return [String]
     #
     # @!attribute [rw] pseudonym
@@ -235,6 +231,128 @@ module Aws::ACMPCA
       include Aws::Structure
     end
 
+    # Contains X.509 certificate information to be placed in an issued
+    # certificate. An `APIPassthrough` or `APICSRPassthrough` template
+    # variant must be selected, or else this parameter is ignored.
+    #
+    # If conflicting or duplicate certificate information is supplied from
+    # other sources, ACM Private CA applies [order of operation rules][1] to
+    # determine what information is used.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html#template-order-of-operations
+    #
+    # @note When making an API call, you may pass ApiPassthrough
+    #   data as a hash:
+    #
+    #       {
+    #         extensions: {
+    #           certificate_policies: [
+    #             {
+    #               cert_policy_id: "CustomObjectIdentifier", # required
+    #               policy_qualifiers: [
+    #                 {
+    #                   policy_qualifier_id: "CPS", # required, accepts CPS
+    #                   qualifier: { # required
+    #                     cps_uri: "String256", # required
+    #                   },
+    #                 },
+    #               ],
+    #             },
+    #           ],
+    #           extended_key_usage: [
+    #             {
+    #               extended_key_usage_type: "SERVER_AUTH", # accepts SERVER_AUTH, CLIENT_AUTH, CODE_SIGNING, EMAIL_PROTECTION, TIME_STAMPING, OCSP_SIGNING, SMART_CARD_LOGIN, DOCUMENT_SIGNING, CERTIFICATE_TRANSPARENCY
+    #               extended_key_usage_object_identifier: "CustomObjectIdentifier",
+    #             },
+    #           ],
+    #           key_usage: {
+    #             digital_signature: false,
+    #             non_repudiation: false,
+    #             key_encipherment: false,
+    #             data_encipherment: false,
+    #             key_agreement: false,
+    #             key_cert_sign: false,
+    #             crl_sign: false,
+    #             encipher_only: false,
+    #             decipher_only: false,
+    #           },
+    #           subject_alternative_names: [
+    #             {
+    #               other_name: {
+    #                 type_id: "CustomObjectIdentifier", # required
+    #                 value: "String256", # required
+    #               },
+    #               rfc_822_name: "String256",
+    #               dns_name: "String253",
+    #               directory_name: {
+    #                 country: "CountryCodeString",
+    #                 organization: "String64",
+    #                 organizational_unit: "String64",
+    #                 distinguished_name_qualifier: "ASN1PrintableString64",
+    #                 state: "String128",
+    #                 common_name: "String64",
+    #                 serial_number: "ASN1PrintableString64",
+    #                 locality: "String128",
+    #                 title: "String64",
+    #                 surname: "String40",
+    #                 given_name: "String16",
+    #                 initials: "String5",
+    #                 pseudonym: "String128",
+    #                 generation_qualifier: "String3",
+    #               },
+    #               edi_party_name: {
+    #                 party_name: "String256", # required
+    #                 name_assigner: "String256",
+    #               },
+    #               uniform_resource_identifier: "String253",
+    #               ip_address: "String39",
+    #               registered_id: "CustomObjectIdentifier",
+    #             },
+    #           ],
+    #         },
+    #         subject: {
+    #           country: "CountryCodeString",
+    #           organization: "String64",
+    #           organizational_unit: "String64",
+    #           distinguished_name_qualifier: "ASN1PrintableString64",
+    #           state: "String128",
+    #           common_name: "String64",
+    #           serial_number: "ASN1PrintableString64",
+    #           locality: "String128",
+    #           title: "String64",
+    #           surname: "String40",
+    #           given_name: "String16",
+    #           initials: "String5",
+    #           pseudonym: "String128",
+    #           generation_qualifier: "String3",
+    #         },
+    #       }
+    #
+    # @!attribute [rw] extensions
+    #   Specifies X.509 extension information for a certificate.
+    #   @return [Types::Extensions]
+    #
+    # @!attribute [rw] subject
+    #   Contains information about the certificate subject. The `Subject`
+    #   field in the certificate identifies the entity that owns or controls
+    #   the public key in the certificate. The entity can be a user,
+    #   computer, device, or service. The `Subject `must contain an X.500
+    #   distinguished name (DN). A DN is a sequence of relative
+    #   distinguished names (RDNs). The RDNs are separated by commas in the
+    #   certificate.
+    #   @return [Types::ASN1Subject]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/ApiPassthrough AWS API Documentation
+    #
+    class ApiPassthrough < Struct.new(
+      :extensions,
+      :subject)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about your private certificate authority (CA).
     # Your private CA can issue and revoke X.509 digital certificates.
     # Digital certificates verify that the entity named in the certificate
@@ -314,6 +432,20 @@ module Aws::ACMPCA
     #   [1]: https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeleteCertificateAuthorityRequest.html
     #   @return [Time]
     #
+    # @!attribute [rw] key_storage_security_standard
+    #   Defines a cryptographic key management compliance standard used for
+    #   handling CA keys.
+    #
+    #   Default: FIPS\_140\_2\_LEVEL\_3\_OR\_HIGHER
+    #
+    #   Note: AWS Region ap-northeast-3 supports only
+    #   FIPS\_140\_2\_LEVEL\_2\_OR\_HIGHER. You must explicitly specify this
+    #   parameter and value when creating a CA in that Region. Specifying a
+    #   different value (or no value) results in an `InvalidArgsException`
+    #   with the message "A certificate authority cannot be created in this
+    #   region with the specified security standard."
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/CertificateAuthority AWS API Documentation
     #
     class CertificateAuthority < Struct.new(
@@ -329,7 +461,8 @@ module Aws::ACMPCA
       :failure_reason,
       :certificate_authority_configuration,
       :revocation_configuration,
-      :restorable_until)
+      :restorable_until,
+      :key_storage_security_standard)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -621,10 +754,12 @@ module Aws::ACMPCA
     #             expiration_in_days: 1,
     #             custom_cname: "String253",
     #             s3_bucket_name: "String3To255",
+    #             s3_object_acl: "PUBLIC_READ", # accepts PUBLIC_READ, BUCKET_OWNER_FULL_CONTROL
     #           },
     #         },
     #         certificate_authority_type: "ROOT", # required, accepts ROOT, SUBORDINATE
     #         idempotency_token: "IdempotencyToken",
+    #         key_storage_security_standard: "FIPS_140_2_LEVEL_2_OR_HIGHER", # accepts FIPS_140_2_LEVEL_2_OR_HIGHER, FIPS_140_2_LEVEL_3_OR_HIGHER
     #         tags: [
     #           {
     #             key: "TagKey", # required
@@ -656,13 +791,30 @@ module Aws::ACMPCA
     #   @return [String]
     #
     # @!attribute [rw] idempotency_token
-    #   Alphanumeric string that can be used to distinguish between calls to
-    #   **CreateCertificateAuthority**. For a given token, ACM Private CA
-    #   creates exactly one CA. If you issue a subsequent call using the
-    #   same token, ACM Private CA returns the ARN of the existing CA and
-    #   takes no further action. If you change the idempotency token across
-    #   multiple calls, ACM Private CA creates a unique CA for each unique
-    #   token.
+    #   Custom string that can be used to distinguish between calls to the
+    #   **CreateCertificateAuthority** action. Idempotency tokens for
+    #   **CreateCertificateAuthority** time out after five minutes.
+    #   Therefore, if you call **CreateCertificateAuthority** multiple times
+    #   with the same idempotency token within five minutes, ACM Private CA
+    #   recognizes that you are requesting only certificate authority and
+    #   will issue only one. If you change the idempotency token for each
+    #   call, PCA recognizes that you are requesting multiple certificate
+    #   authorities.
+    #   @return [String]
+    #
+    # @!attribute [rw] key_storage_security_standard
+    #   Specifies a cryptographic key management compliance standard used
+    #   for handling CA keys.
+    #
+    #   Default: FIPS\_140\_2\_LEVEL\_3\_OR\_HIGHER
+    #
+    #   Note: `FIPS_140_2_LEVEL_3_OR_HIGHER` is not supported in Region
+    #   ap-northeast-3. When creating a CA in the ap-northeast-3, you must
+    #   provide `FIPS_140_2_LEVEL_2_OR_HIGHER` as the argument for
+    #   `KeyStorageSecurityStandard`. Failure to do this results in an
+    #   `InvalidArgsException` with the message, "A certificate authority
+    #   cannot be created in this region with the specified security
+    #   standard."
     #   @return [String]
     #
     # @!attribute [rw] tags
@@ -683,6 +835,7 @@ module Aws::ACMPCA
       :revocation_configuration,
       :certificate_authority_type,
       :idempotency_token,
+      :key_storage_security_standard,
       :tags)
       SENSITIVE = []
       include Aws::Structure
@@ -764,7 +917,7 @@ module Aws::ACMPCA
     # Points** extension of each certificate it issues. Your S3 bucket
     # policy must give write permission to ACM Private CA.
     #
-    # ACM Private CAA assets that are stored in Amazon S3 can be protected
+    # ACM Private CA assets that are stored in Amazon S3 can be protected
     # with encryption. For more information, see [Encrypting Your CRLs][1].
     #
     # Your private CA uses the value in the **ExpirationInDays** parameter
@@ -833,6 +986,7 @@ module Aws::ACMPCA
     #         expiration_in_days: 1,
     #         custom_cname: "String253",
     #         s3_bucket_name: "String3To255",
+    #         s3_object_acl: "PUBLIC_READ", # accepts PUBLIC_READ, BUCKET_OWNER_FULL_CONTROL
     #       }
     #
     # @!attribute [rw] enabled
@@ -865,12 +1019,39 @@ module Aws::ACMPCA
     #   is placed into the **CRL Distribution Points** extension of the
     #   issued certificate. You can change the name of your bucket by
     #   calling the [UpdateCertificateAuthority][1] action. You must specify
-    #   a bucket policy that allows ACM Private CA to write the CRL to your
-    #   bucket.
+    #   a [bucket policy][2] that allows ACM Private CA to write the CRL to
+    #   your bucket.
     #
     #
     #
     #   [1]: https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_UpdateCertificateAuthority.html
+    #   [2]: https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaCreateCa.html#s3-policies
+    #   @return [String]
+    #
+    # @!attribute [rw] s3_object_acl
+    #   Determines whether the CRL will be publicly readable or privately
+    #   held in the CRL Amazon S3 bucket. If you choose PUBLIC\_READ, the
+    #   CRL will be accessible over the public internet. If you choose
+    #   BUCKET\_OWNER\_FULL\_CONTROL, only the owner of the CRL S3 bucket
+    #   can access the CRL, and your PKI clients may need an alternative
+    #   method of access.
+    #
+    #   If no value is specified, the default is `PUBLIC_READ`.
+    #
+    #   *Note:* This default can cause CA creation to fail in some
+    #   circumstances. If you have have enabled the Block Public Access
+    #   (BPA) feature in your S3 account, then you must specify the value of
+    #   this parameter as `BUCKET_OWNER_FULL_CONTROL`, and not doing so
+    #   results in an error. If you have disabled BPA in S3, then you can
+    #   specify either `BUCKET_OWNER_FULL_CONTROL` or `PUBLIC_READ` as the
+    #   value.
+    #
+    #   For more information, see [Blocking public access to the S3
+    #   bucket][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaCreateCa.html#s3-bpa
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/CrlConfiguration AWS API Documentation
@@ -879,7 +1060,8 @@ module Aws::ACMPCA
       :enabled,
       :expiration_in_days,
       :custom_cname,
-      :s3_bucket_name)
+      :s3_bucket_name,
+      :s3_object_acl)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -1211,10 +1393,160 @@ module Aws::ACMPCA
       include Aws::Structure
     end
 
+    # Specifies additional purposes for which the certified public key may
+    # be used other than basic purposes indicated in the `KeyUsage`
+    # extension.
+    #
+    # @note When making an API call, you may pass ExtendedKeyUsage
+    #   data as a hash:
+    #
+    #       {
+    #         extended_key_usage_type: "SERVER_AUTH", # accepts SERVER_AUTH, CLIENT_AUTH, CODE_SIGNING, EMAIL_PROTECTION, TIME_STAMPING, OCSP_SIGNING, SMART_CARD_LOGIN, DOCUMENT_SIGNING, CERTIFICATE_TRANSPARENCY
+    #         extended_key_usage_object_identifier: "CustomObjectIdentifier",
+    #       }
+    #
+    # @!attribute [rw] extended_key_usage_type
+    #   Specifies a standard `ExtendedKeyUsage` as defined as in [RFC
+    #   5280][1].
+    #
+    #
+    #
+    #   [1]: https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+    #   @return [String]
+    #
+    # @!attribute [rw] extended_key_usage_object_identifier
+    #   Specifies a custom `ExtendedKeyUsage` with an object identifier
+    #   (OID).
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/ExtendedKeyUsage AWS API Documentation
+    #
+    class ExtendedKeyUsage < Struct.new(
+      :extended_key_usage_type,
+      :extended_key_usage_object_identifier)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Contains X.509 extension information for a certificate.
+    #
+    # @note When making an API call, you may pass Extensions
+    #   data as a hash:
+    #
+    #       {
+    #         certificate_policies: [
+    #           {
+    #             cert_policy_id: "CustomObjectIdentifier", # required
+    #             policy_qualifiers: [
+    #               {
+    #                 policy_qualifier_id: "CPS", # required, accepts CPS
+    #                 qualifier: { # required
+    #                   cps_uri: "String256", # required
+    #                 },
+    #               },
+    #             ],
+    #           },
+    #         ],
+    #         extended_key_usage: [
+    #           {
+    #             extended_key_usage_type: "SERVER_AUTH", # accepts SERVER_AUTH, CLIENT_AUTH, CODE_SIGNING, EMAIL_PROTECTION, TIME_STAMPING, OCSP_SIGNING, SMART_CARD_LOGIN, DOCUMENT_SIGNING, CERTIFICATE_TRANSPARENCY
+    #             extended_key_usage_object_identifier: "CustomObjectIdentifier",
+    #           },
+    #         ],
+    #         key_usage: {
+    #           digital_signature: false,
+    #           non_repudiation: false,
+    #           key_encipherment: false,
+    #           data_encipherment: false,
+    #           key_agreement: false,
+    #           key_cert_sign: false,
+    #           crl_sign: false,
+    #           encipher_only: false,
+    #           decipher_only: false,
+    #         },
+    #         subject_alternative_names: [
+    #           {
+    #             other_name: {
+    #               type_id: "CustomObjectIdentifier", # required
+    #               value: "String256", # required
+    #             },
+    #             rfc_822_name: "String256",
+    #             dns_name: "String253",
+    #             directory_name: {
+    #               country: "CountryCodeString",
+    #               organization: "String64",
+    #               organizational_unit: "String64",
+    #               distinguished_name_qualifier: "ASN1PrintableString64",
+    #               state: "String128",
+    #               common_name: "String64",
+    #               serial_number: "ASN1PrintableString64",
+    #               locality: "String128",
+    #               title: "String64",
+    #               surname: "String40",
+    #               given_name: "String16",
+    #               initials: "String5",
+    #               pseudonym: "String128",
+    #               generation_qualifier: "String3",
+    #             },
+    #             edi_party_name: {
+    #               party_name: "String256", # required
+    #               name_assigner: "String256",
+    #             },
+    #             uniform_resource_identifier: "String253",
+    #             ip_address: "String39",
+    #             registered_id: "CustomObjectIdentifier",
+    #           },
+    #         ],
+    #       }
+    #
+    # @!attribute [rw] certificate_policies
+    #   Contains a sequence of one or more policy information terms, each of
+    #   which consists of an object identifier (OID) and optional
+    #   qualifiers. For more information, see NIST's definition of [Object
+    #   Identifier (OID)][1].
+    #
+    #   In an end-entity certificate, these terms indicate the policy under
+    #   which the certificate was issued and the purposes for which it may
+    #   be used. In a CA certificate, these terms limit the set of policies
+    #   for certification paths that include this certificate.
+    #
+    #
+    #
+    #   [1]: https://csrc.nist.gov/glossary/term/Object_Identifier
+    #   @return [Array<Types::PolicyInformation>]
+    #
+    # @!attribute [rw] extended_key_usage
+    #   Specifies additional purposes for which the certified public key may
+    #   be used other than basic purposes indicated in the `KeyUsage`
+    #   extension.
+    #   @return [Array<Types::ExtendedKeyUsage>]
+    #
+    # @!attribute [rw] key_usage
+    #   Defines one or more purposes for which the key contained in the
+    #   certificate can be used. Default value for each option is false.
+    #   @return [Types::KeyUsage]
+    #
+    # @!attribute [rw] subject_alternative_names
+    #   The subject alternative name extension allows identities to be bound
+    #   to the subject of the certificate. These identities may be included
+    #   in addition to or in place of the identity in the subject field of
+    #   the certificate.
+    #   @return [Array<Types::GeneralName>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/Extensions AWS API Documentation
+    #
+    class Extensions < Struct.new(
+      :certificate_policies,
+      :extended_key_usage,
+      :key_usage,
+      :subject_alternative_names)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Describes an ASN.1 X.400 `GeneralName` as defined in [RFC 5280][1].
-    # Only one of the following naming options should be providied.
-    # Providing more than one option results in an `InvalidArgsException`
-    # error.
+    # Only one of the following naming options should be provided. Providing
+    # more than one option results in an `InvalidArgsException` error.
     #
     #
     #
@@ -1272,16 +1604,13 @@ module Aws::ACMPCA
     #   @return [String]
     #
     # @!attribute [rw] directory_name
-    #   Contains information about the certificate subject. The certificate
-    #   can be one issued by your private certificate authority (CA) or it
-    #   can be your private CA certificate. The **Subject** field in the
-    #   certificate identifies the entity that owns or controls the public
-    #   key in the certificate. The entity can be a user, computer, device,
-    #   or service. The **Subject** must contain an X.500 distinguished name
-    #   (DN). A DN is a sequence of relative distinguished names (RDNs). The
-    #   RDNs are separated by commas in the certificate. The DN must be
-    #   unique for each entity, but your private CA can issue more than one
-    #   certificate with the same DN to the same entity.
+    #   Contains information about the certificate subject. The `Subject`
+    #   field in the certificate identifies the entity that owns or controls
+    #   the public key in the certificate. The entity can be a user,
+    #   computer, device, or service. The `Subject `must contain an X.500
+    #   distinguished name (DN). A DN is a sequence of relative
+    #   distinguished names (RDNs). The RDNs are separated by commas in the
+    #   certificate.
     #   @return [Types::ASN1Subject]
     #
     # @!attribute [rw] edi_party_name
@@ -1644,6 +1973,89 @@ module Aws::ACMPCA
     #   data as a hash:
     #
     #       {
+    #         api_passthrough: {
+    #           extensions: {
+    #             certificate_policies: [
+    #               {
+    #                 cert_policy_id: "CustomObjectIdentifier", # required
+    #                 policy_qualifiers: [
+    #                   {
+    #                     policy_qualifier_id: "CPS", # required, accepts CPS
+    #                     qualifier: { # required
+    #                       cps_uri: "String256", # required
+    #                     },
+    #                   },
+    #                 ],
+    #               },
+    #             ],
+    #             extended_key_usage: [
+    #               {
+    #                 extended_key_usage_type: "SERVER_AUTH", # accepts SERVER_AUTH, CLIENT_AUTH, CODE_SIGNING, EMAIL_PROTECTION, TIME_STAMPING, OCSP_SIGNING, SMART_CARD_LOGIN, DOCUMENT_SIGNING, CERTIFICATE_TRANSPARENCY
+    #                 extended_key_usage_object_identifier: "CustomObjectIdentifier",
+    #               },
+    #             ],
+    #             key_usage: {
+    #               digital_signature: false,
+    #               non_repudiation: false,
+    #               key_encipherment: false,
+    #               data_encipherment: false,
+    #               key_agreement: false,
+    #               key_cert_sign: false,
+    #               crl_sign: false,
+    #               encipher_only: false,
+    #               decipher_only: false,
+    #             },
+    #             subject_alternative_names: [
+    #               {
+    #                 other_name: {
+    #                   type_id: "CustomObjectIdentifier", # required
+    #                   value: "String256", # required
+    #                 },
+    #                 rfc_822_name: "String256",
+    #                 dns_name: "String253",
+    #                 directory_name: {
+    #                   country: "CountryCodeString",
+    #                   organization: "String64",
+    #                   organizational_unit: "String64",
+    #                   distinguished_name_qualifier: "ASN1PrintableString64",
+    #                   state: "String128",
+    #                   common_name: "String64",
+    #                   serial_number: "ASN1PrintableString64",
+    #                   locality: "String128",
+    #                   title: "String64",
+    #                   surname: "String40",
+    #                   given_name: "String16",
+    #                   initials: "String5",
+    #                   pseudonym: "String128",
+    #                   generation_qualifier: "String3",
+    #                 },
+    #                 edi_party_name: {
+    #                   party_name: "String256", # required
+    #                   name_assigner: "String256",
+    #                 },
+    #                 uniform_resource_identifier: "String253",
+    #                 ip_address: "String39",
+    #                 registered_id: "CustomObjectIdentifier",
+    #               },
+    #             ],
+    #           },
+    #           subject: {
+    #             country: "CountryCodeString",
+    #             organization: "String64",
+    #             organizational_unit: "String64",
+    #             distinguished_name_qualifier: "ASN1PrintableString64",
+    #             state: "String128",
+    #             common_name: "String64",
+    #             serial_number: "ASN1PrintableString64",
+    #             locality: "String128",
+    #             title: "String64",
+    #             surname: "String40",
+    #             given_name: "String16",
+    #             initials: "String5",
+    #             pseudonym: "String128",
+    #             generation_qualifier: "String3",
+    #           },
+    #         },
     #         certificate_authority_arn: "Arn", # required
     #         csr: "data", # required
     #         signing_algorithm: "SHA256WITHECDSA", # required, accepts SHA256WITHECDSA, SHA384WITHECDSA, SHA512WITHECDSA, SHA256WITHRSA, SHA384WITHRSA, SHA512WITHRSA
@@ -1652,9 +2064,30 @@ module Aws::ACMPCA
     #           value: 1, # required
     #           type: "END_DATE", # required, accepts END_DATE, ABSOLUTE, DAYS, MONTHS, YEARS
     #         },
+    #         validity_not_before: {
+    #           value: 1, # required
+    #           type: "END_DATE", # required, accepts END_DATE, ABSOLUTE, DAYS, MONTHS, YEARS
+    #         },
     #         idempotency_token: "IdempotencyToken",
     #       }
     #
+    # @!attribute [rw] api_passthrough
+    #   Specifies X.509 certificate information to be included in the issued
+    #   certificate. An `APIPassthrough` or `APICSRPassthrough` template
+    #   variant must be selected, or else this parameter is ignored. For
+    #   more information about using these templates, see [Understanding
+    #   Certificate Templates][1].
+    #
+    #   If conflicting or duplicate certificate information is supplied
+    #   during certificate issuance, ACM Private CA applies [order of
+    #   operation rules][2] to determine what information is used.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html
+    #   [2]: https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html#template-order-of-operations
+    #   @return [Types::ApiPassthrough]
+    #
     # @!attribute [rw] certificate_authority_arn
     #   The Amazon Resource Name (ARN) that was returned when you called
     #   [CreateCertificateAuthority][1]. This must be of the form:
@@ -1669,15 +2102,15 @@ module Aws::ACMPCA
     #
     # @!attribute [rw] csr
     #   The certificate signing request (CSR) for the certificate you want
-    #   to issue. You can use the following OpenSSL command to create the
-    #   CSR and a 2048 bit RSA private key.
+    #   to issue. As an example, you can use the following OpenSSL command
+    #   to create the CSR and a 2048 bit RSA private key.
     #
     #   `openssl req -new -newkey rsa:2048 -days 365 -keyout
     #   private/test_cert_priv_key.pem -out csr/test_cert_.csr`
     #
-    #   If you have a configuration file, you can use the following OpenSSL
-    #   command. The `usr_cert` block in the configuration file contains
-    #   your X509 version 3 extensions.
+    #   If you have a configuration file, you can then use the following
+    #   OpenSSL command. The `usr_cert` block in the configuration file
+    #   contains your X509 version 3 extensions.
     #
     #   `openssl req -new -config openssl_rsa.cnf -extensions usr_cert
     #   -newkey rsa:2048 -days -365 -keyout private/test_cert_priv_key.pem
@@ -1692,7 +2125,8 @@ module Aws::ACMPCA
     #   to be issued.
     #
     #   This parameter should not be confused with the `SigningAlgorithm`
-    #   parameter used to sign a CSR.
+    #   parameter used to sign a CSR in the `CreateCertificateAuthority`
+    #   action.
     #   @return [String]
     #
     # @!attribute [rw] template_arn
@@ -1706,77 +2140,85 @@ module Aws::ACMPCA
     #   Note: The CA depth configured on a subordinate CA certificate must
     #   not exceed the limit set by its parents in the CA hierarchy.
     #
-    #   The following service-owned `TemplateArn` values are supported by
-    #   ACM Private CA:
-    #
-    #   * arn:aws:acm-pca:::template/CodeSigningCertificate/V1
+    #   For a list of `TemplateArn` values supported by ACM Private CA, see
+    #   [Understanding Certificate Templates][2].
     #
-    #   * arn:aws:acm-pca:::template/CodeSigningCertificate\_CSRPassthrough/V1
     #
-    #   * arn:aws:acm-pca:::template/EndEntityCertificate/V1
     #
-    #   * arn:aws:acm-pca:::template/EndEntityCertificate\_CSRPassthrough/V1
-    #
-    #   * arn:aws:acm-pca:::template/EndEntityClientAuthCertificate/V1
-    #
-    #   * arn:aws:acm-pca:::template/EndEntityClientAuthCertificate\_CSRPassthrough/V1
-    #
-    #   * arn:aws:acm-pca:::template/EndEntityServerAuthCertificate/V1
-    #
-    #   * arn:aws:acm-pca:::template/EndEntityServerAuthCertificate\_CSRPassthrough/V1
+    #   [1]: https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaTerms.html#terms-cadepth
+    #   [2]: https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html
+    #   @return [String]
     #
-    #   * arn:aws:acm-pca:::template/OCSPSigningCertificate/V1
+    # @!attribute [rw] validity
+    #   Information describing the end of the validity period of the
+    #   certificate. This parameter sets the “Not After” date for the
+    #   certificate.
     #
-    #   * arn:aws:acm-pca:::template/OCSPSigningCertificate\_CSRPassthrough/V1
+    #   Certificate validity is the period of time during which a
+    #   certificate is valid. Validity can be expressed as an explicit date
+    #   and time when the certificate expires, or as a span of time after
+    #   issuance, stated in days, months, or years. For more information,
+    #   see [Validity][1] in RFC 5280.
     #
-    #   * arn:aws:acm-pca:::template/RootCACertificate/V1
+    #   This value is unaffected when `ValidityNotBefore` is also specified.
+    #   For example, if `Validity` is set to 20 days in the future, the
+    #   certificate will expire 20 days from issuance time regardless of the
+    #   `ValidityNotBefore` value.
     #
-    #   * arn:aws:acm-pca:::template/SubordinateCACertificate\_PathLen0/V1
+    #   The end of the validity period configured on a certificate must not
+    #   exceed the limit set on its parents in the CA hierarchy.
     #
-    #   * arn:aws:acm-pca:::template/SubordinateCACertificate\_PathLen1/V1
     #
-    #   * arn:aws:acm-pca:::template/SubordinateCACertificate\_PathLen2/V1
     #
-    #   * arn:aws:acm-pca:::template/SubordinateCACertificate\_PathLen3/V1
+    #   [1]: https://tools.ietf.org/html/rfc5280#section-4.1.2.5
+    #   @return [Types::Validity]
     #
-    #   For more information, see [Using Templates][2].
+    # @!attribute [rw] validity_not_before
+    #   Information describing the start of the validity period of the
+    #   certificate. This parameter sets the “Not Before" date for the
+    #   certificate.
     #
+    #   By default, when issuing a certificate, ACM Private CA sets the
+    #   "Not Before" date to the issuance time minus 60 minutes. This
+    #   compensates for clock inconsistencies across computer systems. The
+    #   `ValidityNotBefore` parameter can be used to customize the “Not
+    #   Before” value.
     #
+    #   Unlike the `Validity` parameter, the `ValidityNotBefore` parameter
+    #   is optional.
     #
-    #   [1]: https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaTerms.html#terms-cadepth
-    #   [2]: https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html
-    #   @return [String]
+    #   The `ValidityNotBefore` value is expressed as an explicit date and
+    #   time, using the `Validity` type value `ABSOLUTE`. For more
+    #   information, see [Validity][1] in this API reference and
+    #   [Validity][2] in RFC 5280.
     #
-    # @!attribute [rw] validity
-    #   Information describing the validity period of the certificate.
     #
-    #   When issuing a certificate, ACM Private CA sets the "Not Before"
-    #   date in the validity field to date and time minus 60 minutes. This
-    #   is intended to compensate for time inconsistencies across systems of
-    #   60 minutes or less.
     #
-    #   The validity period configured on a certificate must not exceed the
-    #   limit set by its parents in the CA hierarchy.
+    #   [1]: https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_Validity.html
+    #   [2]: https://tools.ietf.org/html/rfc5280#section-4.1.2.5
     #   @return [Types::Validity]
     #
     # @!attribute [rw] idempotency_token
-    #   Custom string that can be used to distinguish between calls to the
-    #   **IssueCertificate** action. Idempotency tokens time out after one
-    #   hour. Therefore, if you call **IssueCertificate** multiple times
-    #   with the same idempotency token within 5 minutes, ACM Private CA
-    #   recognizes that you are requesting only one certificate and will
-    #   issue only one. If you change the idempotency token for each call,
-    #   PCA recognizes that you are requesting multiple certificates.
+    #   Alphanumeric string that can be used to distinguish between calls to
+    #   the **IssueCertificate** action. Idempotency tokens for
+    #   **IssueCertificate** time out after one minute. Therefore, if you
+    #   call **IssueCertificate** multiple times with the same idempotency
+    #   token within one minute, ACM Private CA recognizes that you are
+    #   requesting only one certificate and will issue only one. If you
+    #   change the idempotency token for each call, PCA recognizes that you
+    #   are requesting multiple certificates.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/IssueCertificateRequest AWS API Documentation
     #
     class IssueCertificateRequest < Struct.new(
+      :api_passthrough,
       :certificate_authority_arn,
       :csr,
       :signing_algorithm,
       :template_arn,
       :validity,
+      :validity_not_before,
       :idempotency_token)
       SENSITIVE = []
       include Aws::Structure
@@ -2212,6 +2654,79 @@ module Aws::ACMPCA
       include Aws::Structure
     end
 
+    # Defines the X.509 `CertificatePolicies` extension.
+    #
+    # @note When making an API call, you may pass PolicyInformation
+    #   data as a hash:
+    #
+    #       {
+    #         cert_policy_id: "CustomObjectIdentifier", # required
+    #         policy_qualifiers: [
+    #           {
+    #             policy_qualifier_id: "CPS", # required, accepts CPS
+    #             qualifier: { # required
+    #               cps_uri: "String256", # required
+    #             },
+    #           },
+    #         ],
+    #       }
+    #
+    # @!attribute [rw] cert_policy_id
+    #   Specifies the object identifier (OID) of the certificate policy
+    #   under which the certificate was issued. For more information, see
+    #   NIST's definition of [Object Identifier (OID)][1].
+    #
+    #
+    #
+    #   [1]: https://csrc.nist.gov/glossary/term/Object_Identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] policy_qualifiers
+    #   Modifies the given `CertPolicyId` with a qualifier. ACM Private CA
+    #   supports the certification practice statement (CPS) qualifier.
+    #   @return [Array<Types::PolicyQualifierInfo>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/PolicyInformation AWS API Documentation
+    #
+    class PolicyInformation < Struct.new(
+      :cert_policy_id,
+      :policy_qualifiers)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Modifies the `CertPolicyId` of a `PolicyInformation` object with a
+    # qualifier. ACM Private CA supports the certification practice
+    # statement (CPS) qualifier.
+    #
+    # @note When making an API call, you may pass PolicyQualifierInfo
+    #   data as a hash:
+    #
+    #       {
+    #         policy_qualifier_id: "CPS", # required, accepts CPS
+    #         qualifier: { # required
+    #           cps_uri: "String256", # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] policy_qualifier_id
+    #   Identifies the qualifier modifying a `CertPolicyId`.
+    #   @return [String]
+    #
+    # @!attribute [rw] qualifier
+    #   Defines the qualifier type. ACM Private CA supports the use of a URI
+    #   for a CPS qualifier in this field.
+    #   @return [Types::Qualifier]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/PolicyQualifierInfo AWS API Documentation
+    #
+    class PolicyQualifierInfo < Struct.new(
+      :policy_qualifier_id,
+      :qualifier)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @note When making an API call, you may pass PutPolicyRequest
     #   data as a hash:
     #
@@ -2233,7 +2748,7 @@ module Aws::ACMPCA
     #   @return [String]
     #
     # @!attribute [rw] policy
-    #   The path and filename of a JSON-formatted IAM policy to attach to
+    #   The path and file name of a JSON-formatted IAM policy to attach to
     #   the specified private CA resource. If this policy does not contain
     #   all required statements or if it includes any statement that is not
     #   allowed, the `PutPolicy` action returns an `InvalidPolicyException`.
@@ -2254,6 +2769,34 @@ module Aws::ACMPCA
       include Aws::Structure
     end
 
+    # Defines a `PolicyInformation` qualifier. ACM Private CA supports the
+    # [certification practice statement (CPS) qualifier][1] defined in RFC
+    # 5280.
+    #
+    #
+    #
+    # [1]: https://tools.ietf.org/html/rfc5280#section-4.2.1.4
+    #
+    # @note When making an API call, you may pass Qualifier
+    #   data as a hash:
+    #
+    #       {
+    #         cps_uri: "String256", # required
+    #       }
+    #
+    # @!attribute [rw] cps_uri
+    #   Contains a pointer to a certification practice statement (CPS)
+    #   published by the CA.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/acm-pca-2017-08-22/Qualifier AWS API Documentation
+    #
+    class Qualifier < Struct.new(
+      :cps_uri)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Your request has already been completed.
     #
     # @!attribute [rw] message
@@ -2356,6 +2899,7 @@ module Aws::ACMPCA
     #           expiration_in_days: 1,
     #           custom_cname: "String253",
     #           s3_bucket_name: "String3To255",
+    #           s3_object_acl: "PUBLIC_READ", # accepts PUBLIC_READ, BUCKET_OWNER_FULL_CONTROL
     #         },
     #       }
     #
@@ -2561,6 +3105,7 @@ module Aws::ACMPCA
     #             expiration_in_days: 1,
     #             custom_cname: "String253",
     #             s3_bucket_name: "String3To255",
+    #             s3_object_acl: "PUBLIC_READ", # accepts PUBLIC_READ, BUCKET_OWNER_FULL_CONTROL
     #           },
     #         },
     #         status: "CREATING", # accepts CREATING, PENDING_CERTIFICATE, ACTIVE, DELETED, DISABLED, EXPIRED, FAILED
@@ -2594,17 +3139,20 @@ module Aws::ACMPCA
 
     # Validity specifies the period of time during which a certificate is
     # valid. Validity can be expressed as an explicit date and time when the
-    # certificate expires, or as a span of time after issuance, stated in
-    # days, months, or years. For more information, see [Validity][1] in RFC
-    # 5280.
+    # validity of a certificate starts or expires, or as a span of time
+    # after issuance, stated in days, months, or years. For more
+    # information, see [Validity][1] in RFC 5280.
     #
-    # You can issue a certificate by calling the [IssueCertificate][2]
-    # action.
+    # ACM Private CA API consumes the `Validity` data type differently in
+    # two distinct parameters of the `IssueCertificate` action. The required
+    # parameter `IssueCertificate`\:`Validity` specifies the end of a
+    # certificate's validity period. The optional parameter
+    # `IssueCertificate`\:`ValidityNotBefore` specifies a customized
+    # starting time for the validity period.
     #
     #
     #
     # [1]: https://tools.ietf.org/html/rfc5280#section-4.1.2.5
-    # [2]: https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_IssueCertificate.html
     #
     # @note When making an API call, you may pass Validity
     #   data as a hash:
@@ -2635,8 +3183,9 @@ module Aws::ACMPCA
     #
     #   * Output expiration date/time: 12/31/2049 23:59:59
     #
-    #   `ABSOLUTE`\: The specific date and time when the certificate will
-    #   expire, expressed in seconds since the Unix Epoch.
+    #   `ABSOLUTE`\: The specific date and time when the validity of a
+    #   certificate will start or expire, expressed in seconds since the
+    #   Unix Epoch.
     #
     #   * Sample input value: 2524608000
     #