Question

A company uses AWS Certificate Manager (ACM) to issue public TLS certificates for several externally imported certificates that ACM cannot auto-renew (they were imported from a third-party CA). The security team was recently caught off guard when one imported certificate expired, causing a production outage. They need an automated, low-maintenance solution that proactively alerts the operations team at least 30 days before ANY imported certificate expires, across all accounts in the organization. Which approach BEST meets this requirement?

Accepted Answer

Enable the AWS Config managed rule acm-certificate-expiration-check across the organization, and configure a conformance pack with EventBridge to notify an SNS topic when a certificate is flagged noncompliant.

Answer

Create a Lambda function scheduled with EventBridge that calls acm:ListCertificates daily and publishes to SNS, deploying it manually in every account.

Answer

Rely on the ACM.expiryEventsDaysBeforeExpiry AWS Health event, which ACM automatically emits for imported certificates, and route it to SNS via EventBridge.

Answer

Enable Security Hub and use the AWS Foundational Security Best Practices control for ACM, which suppresses findings until a certificate is within 30 days of expiry.