Certificate

X.509 cert + private key.

class: Secret

Realizing resources

resource	scope	enumerate	required permissions
`aws:acm:certificate`	regional	`acm:ListCertificates`	`acm:ListCertificates`

resource	scope	enumerate	required permissions
`gcp:certificatemanager:certificate`	regional	`certificatemanager.projects.locations.certificates.list`	`certificatemanager.certs.list`

An exportable ACM certificate exposes its private key to any principal that can export it.

An exported ACM private key authenticates as the certificate's DNS/TLS server identity.

Forging a CA-trusted cert lets the principal act as the downstream identity.

A SecureString parameter exposes credential material to any reader.

A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.

azure CanReadSecret

An Automation Account with a legacy RunAs account exposes the RunAs service principal certificate to any runbook via Get-AutomationConnection.

Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.

azure CanReadSecret

A vault self-grant yields read of every secret/cert in the vault.

azure CanReadSecret