Question

A company runs a public-facing application behind an Application Load Balancer. The security team uses an SSL/TLS certificate that was issued by the company's existing third-party certificate authority and then imported into AWS Certificate Manager (ACM). During an audit, the team is concerned about a repeat of a past incident where the certificate expired and caused an outage. Which approach ensures they are proactively warned before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon CloudWatch metric 'DaysToExpiry' and configure a CloudWatch alarm (or an EventBridge rule for the ACM expiration event) to notify the team before expiry.

Answer

Rely on ACM to automatically renew the imported certificate 60 days before expiration, as it does for all certificates in ACM.

Answer

Enable AWS Config managed rule 'acm-certificate-rsa-check' to force renewal of the imported certificate automatically.

Answer

Migrate the certificate's private key into AWS Secrets Manager and enable automatic rotation to replace the certificate before it expires.