Discovery added. Store type changed!

.github/workflows/keyfactor-starter-workflow.yml

@@ -1,4 +1,4 @@
-name: Keyfactor Bootstrap Workflow 
+name: Keyfactor Bootstrap Workflow
 
 on:
   workflow_dispatch:
@@ -11,10 +11,9 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
     secrets:
-      token: ${{ secrets.V2BUILDTOKEN}}
-      APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
-      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
-      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
-      scan_token: ${{ secrets.SAST_TOKEN }}
+      token: ${{ secrets.V2BUILDTOKEN}} # REQUIRED
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} # Only required for golang builds
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} # Only required for golang builds
+      scan_token: ${{ secrets.SAST_TOKEN }} # REQUIRED

.gitignore

@@ -348,4 +348,6 @@ MigrationBackup/
 
 # Ionide (cross platform F# VS Code tools) working folder
 .ionide/
-/aws-acm-orchestrator.sln.licenseheader
+/.claude/settings.local.json
+/Feature-Spec-Cross-Account-Discovery-1.pdf
+/Ticket.txt

CHANGELOG.md

@@ -1,5 +1,9 @@
-3.0.3
-* Bug Fix - On Management Add/renewal jobs, the leaf certificate is no longer included in the `CertificateChain` sent to ACM. BouncyCastle's `GetCertificateChain` returns the leaf as the first element, and it was already sent separately as the certificate body, causing the leaf to appear twice within the published certificate's chain. When the certificate has no intermediates, the chain is now omitted entirely rather than sent empty.
+3.1.0
+* Added support for cross-account **Discovery**
+  * Discovery enumerates AWS Organizations accounts via `organizations:ListAccounts`, assumes a per-account IAM role (configurable via the new `DiscoveryRoleName` property; default `KeyfactorACMDiscoveryRole`), and scans each account's enabled regions for ACM certificates
+  * Discovered certificate stores use a self-contained `Store Path` of the form `<roleArn>|<region>` that carries both the Role ARN to assume and the AWS Region in a single field; legacy region-only `Store Path` values (with the Role ARN in `Client Machine`) continue to work
+  * Added the `DiscoveryRoleName` store type property
+* Discovery, Inventory, and Management jobs now return descriptive success, warning, and failure messages to Keyfactor Command that identify the exact store (and, for Discovery, the accounts and regions scanned) instead of directing the user to the logs .
 
 3.0.2
 * Bug Fix - On Management jobs, do not send ACM tags if the certificate is being renewed/replaced

aws-acm-orchestrator.sln

@@ -1,14 +1,14 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 16
-VisualStudioVersion = 16.0.30717.126
+# Visual Studio Version 18
+VisualStudioVersion = 18.8.12023.21 stable
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "aws-acm-orchestrator", "aws-acm-orchestrator\aws-acm-orchestrator.csproj", "{9BEDC094-06DC-40C6-B5DF-88B4960D4DCF}"
 EndProject
-Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "aws-acm-orchestrator.Tests", "aws-acm-orchestrator.Tests\aws-acm-orchestrator.Tests.csproj", "{A1B2C3D4-E5F6-47A8-9B0C-1D2E3F4A5B6C}"
-EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{515E06CB-9355-43EA-AF70-27F066A5C3AF}"
 	ProjectSection(SolutionItems) = preProject
+		docsource\aws-acm-v3.md = docsource\aws-acm-v3.md
+		docsource\content.md = docsource\content.md
 		integration-manifest.json = integration-manifest.json
 		readme_source.md = readme_source.md
 		sample-manifest.json = sample-manifest.json
@@ -47,10 +47,6 @@ Global
 		{9BEDC094-06DC-40C6-B5DF-88B4960D4DCF}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{9BEDC094-06DC-40C6-B5DF-88B4960D4DCF}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{9BEDC094-06DC-40C6-B5DF-88B4960D4DCF}.Release|Any CPU.Build.0 = Release|Any CPU
-		{A1B2C3D4-E5F6-47A8-9B0C-1D2E3F4A5B6C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{A1B2C3D4-E5F6-47A8-9B0C-1D2E3F4A5B6C}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{A1B2C3D4-E5F6-47A8-9B0C-1D2E3F4A5B6C}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{A1B2C3D4-E5F6-47A8-9B0C-1D2E3F4A5B6C}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

aws-acm-orchestrator/Jobs/AuthDescription.cs

@@ -0,0 +1,53 @@
+// Copyright 2025 Keyfactor
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+using Keyfactor.Extensions.Aws.Models;
+
+namespace Keyfactor.Extensions.Orchestrator.Aws.Acm.Jobs
+{
+    /// <summary>
+    /// Produces the canonical name of the AWS credential method a store/job is configured for,
+    /// derived from its auth custom fields. This lets every job log <em>which</em> authentication
+    /// path it actually took (in the same vocabulary the auth library uses) instead of leaving the
+    /// operator to infer it, and gives automated tests a stable, greppable marker.
+    ///
+    /// A Credential-Profile store is distinguished from a plain Default-SDK store by the "[profile]"
+    /// prefix the auth library expects on the role/ARN value.
+    /// </summary>
+    internal static class AuthDescription
+    {
+        public static string DescribeMethod(AuthCustomFieldParameters cf, string roleArn)
+        {
+            if (cf == null)
+                return "Unknown";
+
+            if (cf.UseOAuth)
+                return "OAuthProvider";
+
+            if (cf.UseIAM)
+                return "IamUser";
+
+            if (cf.UseDefaultSdkAuth)
+            {
+                bool usesProfile = !string.IsNullOrWhiteSpace(roleArn) && roleArn.TrimStart().StartsWith("[");
+                string method = usesProfile ? "DefaultSdk_CredentialProfile" : "DefaultSdk";
+                if (cf.DefaultSdkAssumeRole)
+                    method += "_AssumeRole";
+                return method;
+            }
+
+            return "Unknown";
+        }
+    }
+}