Customer-owned · Private processing

Your AWS installation

Manage identity, partner trust and application access. CMS operations run through private Lambda invocation from your authorized AWS workloads.

Organization & identity

Identity

Certificate creation, renewal and public bundle export will be available after the bounded issuer is qualified. No private keys are downloadable.

Partners

Partner trust requires validated certificates and explicit approval.

Public bundle import and approval are not enabled in this implementation checkpoint.

AWS application clients

Registration starts with no permissions. The customer installer deploys each client's worker and crypto binding before it can be activated.

Client permissions

Private Lambda integration

Select a deployed client and its authorized recipients. Run the generated example from that client's AWS workload. This page never accepts or processes a CMS payload.

AWS CLI

Select an active client to generate instructions.

Python SDK

Use the release's invoke.py helper. It checks Lambda FunctionError, CMS status and request identity before writing output. Run either CLI or SDK, not both with the same request ID.

Audit & activity

Metadata only. Expired records are hidden even while storage cleanup is pending.

Operations

Infrastructure changes use the customer-run installer with customer deployment credentials.

Upgrade, recovery and uninstall must preserve retained keys, trust, audit and administrator identities. No destructive action is available from this portal checkpoint.