feat(certificatemanager): key algorithm support for PrivateCertificate and Certificate

packages/aws-cdk-lib/aws-certificatemanager/lib/certificate.ts

@@ -103,6 +103,36 @@ export interface CertificateProps {
   readonly certificateName?: string
 }
 
+/**
+ * Certificate Manager key algorithm
+ *
+ * If you need to use an algorithm that doesn't exist as a static member, you
+ * can instantiate a `KeyAlgorithm` object, e.g: `new KeyAlgorithm('RSA_2048')`.
+ */
+export class KeyAlgorithm {
+  /**
+   * RSA_2048 algorithm
+   */
+  public static readonly RSA_2048 = new KeyAlgorithm("RSA_2048");
+
+  /**
+   * EC_prime256v1 algorithm
+   */
+  public static readonly EC_PRIME256V1 = new KeyAlgorithm("EC_prime256v1");
+
+  /**
+   * EC_secp384r1 algorithm
+   */
+  public static readonly EC_SECP384R1 = new KeyAlgorithm("EC_secp384r1");
+
+  constructor(
+    /**
+     * The name of the algorithm
+     */
+    public readonly name: string
+  ) { };
+}
+
 /**
  * Properties for certificate validation
  */

packages/aws-cdk-lib/aws-certificatemanager/lib/private-certificate.ts

@@ -1,5 +1,5 @@
 import { Construct } from 'constructs';
-import { ICertificate } from './certificate';
+import { ICertificate, KeyAlgorithm } from './certificate';
 import { CertificateBase } from './certificate-base';
 import { CfnCertificate } from './certificatemanager.generated';
 import * as acmpca from '../../aws-acmpca';
@@ -28,6 +28,13 @@ export interface PrivateCertificateProps {
    * Private certificate authority (CA) that will be used to issue the certificate.
    */
   readonly certificateAuthority: acmpca.ICertificateAuthority;
+
+  /**
+   * Specifies the algorithm of the public and private key pair that your certificate uses to encrypt data.
+   *
+   * @default KeyAlgorithm.RSA_2048
+   */
+  readonly keyAlgorithm?: KeyAlgorithm;
 }
 
 /**
@@ -59,6 +66,7 @@ export class PrivateCertificate extends CertificateBase implements ICertificate
       domainName: props.domainName,
       subjectAlternativeNames: props.subjectAlternativeNames,
       certificateAuthorityArn: props.certificateAuthority.certificateAuthorityArn,
+      keyAlgorithm: props.keyAlgorithm?.name,
     });
 
     this.certificateArn = cert.ref;

packages/aws-cdk-lib/aws-certificatemanager/test/private-certificate.test.ts

@@ -1,7 +1,7 @@
-import { Template } from '../../assertions';
+import { Match, Template } from '../../assertions';
 import * as acmpca from '../../aws-acmpca';
 import { Duration, Lazy, Stack } from '../../core';
-import { PrivateCertificate } from '../lib';
+import { KeyAlgorithm, PrivateCertificate } from '../lib';
 
 test('private certificate authority', () => {
   const stack = new Stack();
@@ -100,3 +100,49 @@ test('metricDaysToExpiry', () => {
     renderingProperties: expect.anything(),
   });
 });
+
+describe('Key Algorithm', () => {
+  test('key algorithm is undefined if not provided', () => {
+    const stack = new Stack();
+
+    new PrivateCertificate(stack, 'Certificate', {
+      domainName: 'test.example.com',
+      certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+        'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+      KeyAlgorithm: Match.absent(),
+    });
+  });
+
+  test('Can specify algorithm', () => {
+    const stack = new Stack();
+
+    new PrivateCertificate(stack, 'Certificate', {
+      domainName: 'test.example.com',
+      certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+        'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+        keyAlgorithm: KeyAlgorithm.EC_SECP384R1
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+      KeyAlgorithm: 'EC_secp384r1',
+    });
+  });
+
+  test('Can specify any arbitrary algorithm', () => {
+    const stack = new Stack();
+
+    new PrivateCertificate(stack, 'Certificate', {
+      domainName: 'test.example.com',
+      certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+        'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
+      keyAlgorithm: new KeyAlgorithm("any value"),
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::CertificateManager::Certificate', {
+      KeyAlgorithm: 'any value',
+    });
+  });
+});