Certificate Lifecycle Service  ·  View 03 of 21  ·  People and journeys

Actors and Their Core Journeys

Three populations with almost nothing in common, and two of the actors are not people.

Editable source SVG draw.io All views
Customers Tenant admin 9,000 tenants Goal — Put my own brand on the product and never think about the padlock again. Core journeys Bring a custom domain 24,000 live Check my domain's status Customer security reviewer at renewal and audit Goal — Prove to my auditor that nobody but this vendor can issue for my domain. Core journeys Read the CT record for my domain Revoke the delegation on exit The people who run it Platform SRE 1 primary, 1 secondary Goal — Never be the person who let a certificate expire in production. Core journeys Clear a failing renewal before it matters Answer: what is closest to expiry? Security engineer PKI owner Goal — Be able to revoke and replace the whole estate inside a deadline someone else set. Core journeys Run a root ceremony Rotate an issuing intermediate Rehearse bulk re-issuance Service owner ~300 teams Goal — Get an identity my service can use without ever handling a private key. Core journeys Onboard a service to mTLS Find out why my handshake failed Machines and partners Workload 3,800, 24 h leaves Goal — Hold a valid identity at all times without anyone noticing it changed. Core journeys Renew its own identity 46,000 / day Public CA 2 accounts, ACME Goal — Receive well-formed orders inside my rate limits and validate them once. Core journeys Answer an ACME order Mandate a bulk revocation Endpoint prober every 15 min Goal — Tell the registry what is actually being served, whoever issued it. Core journeys Sweep every known endpoint Report a certificate nobody registered Certificate Lifecycle Service — Actors and Their Core Journeys Person or role Journey / task Application we own External / third party Security / platform The workload and the prober are actors, not components: each has a goal the architecture must serve, and the prober's goal is the one the whole design rests on. v 1.0 · owner Security Platform Architecture · date 2026-09

What each gets to do

  • A tenant admin turns one hostname into a padlock, once, and never returns.
  • A platform SRE finds out about a broken renewal 30 days before anything breaks, and can answer "what is closest to expiry" in one query.
  • A security engineer can rotate an authority, run a ceremony and rehearse replacing the whole public-trust estate against a 24-hour clock.
  • A service owner gets a workload identity without ever touching a private key.

The two non-human actors

  • The workload has a goal — hold a valid identity at all times without anyone noticing it changed — and 46,000 issuances a day exist to serve it.
  • The prober has the goal the whole design rests on: tell the registry what is actually being served, whoever issued it.

Risk

  • The customer security reviewer's journey is the one most easily forgotten: a tenant leaving must be able to withdraw the platform's standing authority to issue for their domain.
◀  High-Level Architecture All views Journey — A Tenant Brings Their Own Domain  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records03-actors-and-journeys