AWS IoT Self-managed certificate signing with CreateCertificateFromCsr API

Question

I have created a certificate provider for AWS IoT:

{
   "certificateProviderName": "my-certificate-provider",
   "certificateProviderArn": "arn:aws:iot:eu-west-1:XXXXX:certificateprovider/my-certificate- provider",
   "lambdaFunctionArn": "arn:aws:lambda:eu-west-1:XXXXX:function:custom-certificate-provider",
   "accountDefaultForOperations": [
       "CreateCertificateFromCsr"
   ],
   "creationDate": "2024-03-19T07:10:20.261000+01:00",
   "lastModifiedDate": "2024-03-19T07:10:20.261000+01:00"
}

And a IoT ca-certificate:

{
   "certificates": [
       {
           "certificateArn": "arn:aws:iot:eu-west-1:XXXXX:cacert/YYYY",
           "certificateId": "YYYY",
           "status": "ACTIVE",
           "creationDate": "2024-03-19T07:58:23.270000+01:00"
       }
   ]
}

Should it work with CreateCertificateFromCsr API / create-certificate-from-csr CLI command? When I'm calling these methods the build-in mechanism is used with Amazon as an Issuer. My Lambda from certificate provider is not invoked.

Answer 1

Actually it works only with the Device provisioning MQTT API. It's confusing because the method name in the API/CLI is the same.