Certificate Lifecycle Service  ·  View 20 of 21  ·  Assurance

Security Trust Zones and Key Custody

Five zones ordered by exposure, and a root that is inside the zones it protects with no path to any of them.

Editable source SVG draw.io All views
Internet — nothing here is trusted Browsers and clients Public CA ACME CT logs Customer DNS Published surface — read-only, higher availability than issuance CRL and OCSP CloudFront Trust bundle mirror Delegated DNS zone Route 53 Control plane — may request a signature, may never produce one Order manager Policy engine Registry Probers egress only Issuance plane — separate credentials, no standing human access Attestation verifier Issuing intermediates Issuance ledger write-once Key custody — hardware, two-person, offline root Online signing modules FIPS 140-2 L3 Offline root ceremony only revocation check ACME signed request PKCS#11 ceremony only Security Trust Zones and Key Custody External / third party Interface / broker Application we own Security / platform Data store synchronous batch The probers sit in the control plane with egress only and reach the estate's endpoints, which are not drawn here. The root is inside the zones it protects but has no path to any of them: it is reached by people in a room, not by a service. The published surface is deliberately the most available tier, because relying parties the platform does not control depend on it. v 1.0 · owner Security Architecture · date 2026-09

Zone rules

  • The control plane may request a signature and may never produce one. Nothing in it can reach a signing module.
  • The issuance plane has separate credentials, a separate audit path and no standing human access.
  • The published surface — CRL, OCSP, trust bundle mirror, delegated DNS zone — is read-only and deliberately the most available tier in the design.

Key custody

  • Signing keys are non-exportable in FIPS 140-2 Level 3 hardware; the root module is physically offline between ceremonies.
  • Two-person control on root ceremonies, issuing-intermediate creation, any relaxation of a profile constraint, and any manual issuance outside a profile.
  • Issuing intermediates carry name constraints where the technology permits, so a compromised private intermediate cannot mint an identity outside its scope.

Risk

  • The platform's own administrative surface is the highest-value target in the estate. It gets separate credentials, no standing access and alerting on every privileged action — and it is the thing most likely to be under-protected because it looks like infrastructure.
◀  The Certificate Lifecycle Loop All views Identity and Authorisation  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records20-security-trust-zones