AWS Private CA now provides detailed certificate issuance logs

Summary

• AWS Private CA adds a new CloudTrail management event (IssueCertificateDetails) that logs full certificate content, issuing CA info, requester identity, and signing status for every issuance.
• The event captures both successful and failed issuances—including failure reasons—and is delivered automatically to the CA owner account with no extra configuration or cost beyond standard CloudTrail pricing.
• These logs can be consumed in real time via EventBridge or queried in batch with Athena for compliance auditing, inventory, algorithm migration tracking, and monitoring.