How do I get notified when my ACM certificate is about to be renewed?

Short description

To set up ACM certificate renewal notifications, first check the certificate's eligibility for automatic renewal. Then, use one of the following methods to receive notifications:

• Monitor certificate expiration with an AWS Config rule and Amazon EventBridge.
• Monitor certificate expiration with an Amazon CloudWatch alarm.
• Monitor failed renewals with an EventBridge rule.

Resolution

Confirm certificate eligibility for automatic renewal

Check your certificate's eligibility for automatic renewal. For information about certificates that are ineligible for managed renewal, see Managed renewal for ACM certificates.

Monitor certificate expiration with an AWS Config rule and EventBridge

To receive renewal notifications before the automated 45 or 60 days, use the acm-certificate-expiration-check AWS Config rule or create an Amazon CloudWatch alarm with the DaysToExpiry metric.

Note: The acm-certificate-expiration-check rule checks all certificates in the AWS Region where you create the rule. It uses the common value of daysToExpiration. To monitor and receive notifications for a specific certificate instead of all certificates in a Region, use the Amazon CloudWatch alarm method in the next section.

Create the AWS Config rule with AWS CloudFormation

1. Open the CloudFormation console.
2. Choose Create stack.
3. Choose Choose an existing template.
4. For Amazon S3 URL, enter http://s3.amazonaws.com/aws-configservice-us-east-1/cloudformation-templates-for-managed-rules/ACM_CERTIFICATE_EXPIRATION_CHECK.template.
5. Choose Next.
6. Enter a Stack name, and then for daysToExpiration, enter the number of days before expiration that you want to be receive a notification.
7. Choose Next.
8. Confirm the configuration settings, and then choose Next.
9. Choose Submit.
10. Verify that the stack's Status is CREATE_COMPLETE.

Create an Amazon EventBridge rule to send notifications

1. Open the EventBridge console.
2. Choose Create rule.
3. For Name, enter a rule name.
4. For Description, enter a rule description.
5. Choose Next.
6. For Event pattern, configure the following settings:
   For Event source, choose AWS services.
   For AWS service, select Config.
   For Event type, select Config Rules Compliance Change.
   For Event Type Specification 1, enter ComplianceChangeNotification.
   For Event Type Specification 2, enter the rule name.
   Note: The CloudFormation template uses acm-certificate-expiration-check as the default config rule name.
7. Choose Next.
8. For Select target(s), select your preferred target for notification, such as an Amazon Simple Notification Service (Amazon SNS) topic.
9. Choose Next.
10. Configure the configuration settings, and then choose Create rule.

Example EventBridge rule pattern:

{  
  "source": ["aws.config"],  
  "detail-type": ["Config Rules Compliance Change"],  
  "detail": {  
    "messageType": ["ComplianceChangeNotification"],  
    "configRuleName": ["acm-certificate-expiration-check"]  
  }  
}

Monitor certificate expiration with a CloudWatch alarm

Use the DaysToExpiry metric with a CloudWatch alarm to monitor a specific certificate and receive a notification at a custom threshold.

Complete the following steps:

1. Open the CloudWatch console.
2. For Alarms, choose All alarms.
3. Choose Select metric.
4. In the search box, enter DaysToExpiry and your certificate's Amazon Resource Name (ARN).
5. In the search results, choose CertificateManager, and then choose Certificate Metrics.
6. Select DaysToExpiry for your certificate.
7. Choose Select metric.
8. Under Specify metric and conditions, for Statistics, choose Maximum.
9. For Conditions, choose Lower/Equal.
10. Enter the number of days before expiration that you want to receive a notification.
11. Choose Next.
12. For Configure actions, select the notification options for your use case.
13. Choose Next.
14. For Add name and description, enter a name for your alarm, and then choose Next.
15. Confirm the configuration settings, and then choose Create alarm.

Monitor failed renewals with an EventBridge rule

Use an EventBridge rule to receive a notification when ACM invokes the ACM Certificate Approaching Expiration event. This event confirms that ACM attempted but failed to automatically renew the certificate.

Complete the following steps:

1. Open the EventBridge console.
2. Choose Create rule.
3. For Name, enter a rule name.
4. For Description, enter a rule description.
5. Choose Next.
6. Under Event pattern, choose Edit pattern.
7. Enter the following event pattern:

   {
     "source": ["aws.acm"],
     "resources": ["arn:aws:acm:REGION:ACCOUNT:certificate/CERTIFICATE_ID"],
     "detail-type": ["ACM Certificate Approaching Expiration"]
   }

   Note: Replace REGION with your Region, ACCOUNT with your AWS account, and CERTIFICATE_ID with your certificate ID.
8. Choose Next.
9. For Select target(s), choose your preferred target for notification, such as an Amazon SNS topic.
10. Choose Next.
11. Confirm the configuration settings, and then choose Create rule.

Related information

Handling failures in managed certificate renewal

Monitoring and logging ACM

Create an Amazon SNS topic and publish messages

EventBridge support for ACM