Question

A CloudOps engineer manages several Application Load Balancers that use TLS certificates issued by AWS Certificate Manager (ACM). Some certificates were imported into ACM from a third-party certificate authority, while others were requested directly from ACM. The security team wants proactive alerts at least 30 days before any certificate expires so they can renew in time. Which approach requires the LEAST ongoing operational effort to ensure the team is notified before expiration?

Accepted Answer

Create an EventBridge rule that matches the ACM 'ACM Certificate Approaching Expiration' event and routes it to an SNS topic to notify the security team.

Answer

Rely on ACM automatic renewal for all certificates, since ACM renews certificates before they expire without any manual intervention.

Answer

Enable the ACM-managed AWS Config rule and use a Lambda function that runs daily to describe each certificate and calculate days to expiry, then publish to SNS.

Answer

Create a CloudWatch alarm on the ACM DaysToExpiry metric for each certificate ARN and set the threshold to 30 days, sending notifications to SNS.