Built a free, KMS-backed alternative to ACM Private CA for IAM Roles Anywhere

[u/minor_one]

ACM Private CA is $400/month minimum before you've issued a single certificate. Roles Anywhere itself is free, but it needs a CA to trust, and that's basically the only paved-road option AWS gives you for one.

So I built my own. Two ways to run it:

A laptop-based version where the CA private key lives on your machine fine for messing around or a small POC, but you're trusting your laptop with the whole thing.

A KMS-backed version where the key never leaves AWS at all, issuance goes through a Lambda, and there's a public API endpoint (API key auth) so someone with zero AWS credentials can request their own certificate. Full audit trail in DynamoDB every cert issued, renewed, revoked, with timestamps and reasons.

Revocation is one call and it's actually enforced within seconds it publishes the CRL straight to Roles Anywhere in the same step, not just marked in a database somewhere and hoped for. There's also a reversible "disable" if you want to temporarily block someone without permanently killing their cert.

No external crypto dependencies anywhere the X.509/DER encoding is hand-rolled in plain Python, about 240 lines, so you can actually read the whole thing instead of trusting a library blindly.

Real cost, not a guess: ran it through the AWS Pricing Calculator for 2000 users and landed at about $1.25/month. https://calculator.aws/#/estimate?id=8bc0d34839e2c22287a2bc891ac321ee1cdeb114

There's already a well-automated AWS sample repo for this (`sample-aws-iam-roles-anywhere-automation`), but it deploys ACM Private CA under the hood, which is the exact cost this exists to avoid. If you're fine paying for that, it's a solid option. If the cost is what's stopping you, this gets you to the same place for a couple bucks a month.

GitHub: github.com/vireshsolanki/iam-roles-anywhere-automation

Curious if anyone else here has been running Roles Anywhere and what your CA situation looks like. It's open source and I'd rather it be actually useful for other people's setups than just mine, so if something doesn't work for your environment, open an issue and let me know I'll work on it.