Certificate Lifecycle Service  ·  View 16 of 21  ·  Operations

Deployment Architecture

Where it runs, where it deliberately does not run, and the number that says how long the estate survives without it.

Editable source SVG draw.io All views
AWS — PKI platform account eu-west-1 — primary, 3 AZ Control plane EKS, 3 AZ AWS Private CA 2 issuing CAs CloudHSM cluster 3 HSMs Registry DynamoDB global table Ledger S3 Object Lock eu-central-1 and us-east-1 — verification and standby Standby control plane warm, reads replica Endpoint probers one per region CRL and OCSP CloudFront, global Offline — not on any network Ceremony facility Offline root hardware, quorum Ceremony record witnessed, filmed Workload clusters 6 EKS, 3 regions Edge estate CloudFront · ALB Public CA probe key backup Certificate Lifecycle Service — Deployment Architecture Application we own Security / platform Data store Interface / broker External / third party synchronous batch The probers are deployed per region and read the estate from outside the control plane's failure domain, so a control-plane outage does not also blind the verification plane. Survival without the control plane is 8 hours, set by the 24-hour leaf renewed at one third of life. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Probers are deployed per region, outside the primary control plane's failure domain, so a control-plane outage does not also blind verification.
  • CRL and OCSP are published globally through CloudFront and held to 99.99%, because relying parties the platform does not control depend on them.
  • The root lives in a ceremony facility on no network. Its recovery path has a human in it by design: RTO ≤ 72 hours.

Fail static

  • A control-plane outage stops issuance and stops nothing else. Existing certificates keep serving; orders queue.
  • Estate survival without the control plane: ≥ 8 hours, which is the renewal margin on a 24-hour leaf. The platform publishes this number rather than discovering it during an incident.

Assumptions

  • Primary eu-west-1 across 3 AZ; eu-central-1 and us-east-1 carry a warm standby control plane and a prober.
  • Registry RPO 0 / RTO ≤ 30 min; issuing intermediate replacement live and distributed ≤ 4 hours, which is why two are kept live.
◀  Revocation and Bulk Re-Issuance Under an External Deadline All views Authority Rotation and Policy Release  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records16-deployment-architecture