Question

A company hosts a public web application behind an Application Load Balancer. The security team imported a third-party TLS certificate into AWS Certificate Manager (ACM) to use on the ALB. They are concerned about an unplanned outage caused by the certificate expiring without notice. What is the MOST operationally efficient way to be alerted before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon EventBridge event and CloudWatch metric for days-to-expiry to trigger an Amazon SNS notification ahead of the expiration date.

Answer

Rely on ACM to automatically renew the imported certificate before it expires, requiring no additional configuration.

Answer

Create an AWS Lambda function that downloads the certificate from the ALB each day and parses the expiration date to send an email.

Answer

Enable AWS Config with a custom rule that periodically calls the third-party certificate authority's API to check validity.