Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have external access, in compliance with FedRamp moderate?
1 Answer
Yes, use of AWS Private CA is in compliance with FedRAMP Moderate (and High). The requirement for FedRAMP is found SC-17:
The organization issues public key certificates under an [Assignment: organization- defined certificate policy] or obtains public key certificates from an approved service provider.
With the following Supplemental Guidance:
For all certificates, organizations manage information system trust stores to ensure only approved trust anchors are in the trust stores. This control addresses both certificates with visibility external to organizational information systems and certificates related to the internal operations of systems, for example, application-specific time services.
Also note that there are some export controls related to certificates:
No export-controlled data may be entered, stored, or processed by AWS Certificate Manager Private Certificate Authority. For example, domain names specified for certificates are not permitted to contain export-controlled data. For example, do not enter export-controlled data into the DomainName or SubjectAlternativeNames fields when requesting a certificate.
References
