How do I get notified when my ACM imported certificates are near expiration?

Short description

To get a notification that your certificate is about to expire, use one of the following methods:

• Configure the ACM Certificate Approaching Expiration event.
• Create a custom Amazon EventBridge rule and AWS Config rule.
• Create an Amazon CloudWatch alarm.

By default, the ACM Certificate Approaching Expiration event sends notifications 45 days before an event's expiration. You can change the day, but you can't exceed 45 days. To set up notifications for more than 45 days before an event's expiration, use a custom EventBridge rule or CloudWatch alarm.

Resolution

Configure the ACM Certificate Approaching Expiration event in EventBridge

Prerequisite: If you don't have an Amazon Simple Notification Service (Amazon SNS) topic, then create a topic. 

Complete the following steps:

1. Open the EventBridge console.
2. In the navigation pane, choose Rules, and then choose Create rule.
3. Enter a Name for your rule.
   Note: You must uniquely name rules that are in the same AWS Region and on the same event bus.
4. For Event bus, select the event bus. To match the rule with events from your AWS account, select AWS default event bus so that the event goes to your account's default event bus.
5. For Rule type, choose Rule with an event pattern, and then choose Next.
6. For Event source, choose AWS events or EventBridge partner events.
7. For Creation method, choose Use pattern form option.
8. In the Event pattern section, complete the following steps:
   For Event source, choose AWS Services.
   For AWS service, choose Certificate Manager.
   For Event type, choose ACM Certificate Approaching Expiration.
9. Choose Next.
10. For Target types, choose AWS Service.
11. For Select a target, choose SNS topic, and then select the Amazon SNS topic.
12. Choose Next.
13. (Optional) Add tags.
14. Choose Next.
15. Review the rule's details, and then choose Create rule.

After you create the rule, you can change the date that you receive the expiration notification. In the PutAccountConfiguration ACM API operation, enter a value between 1-45 for DaysBeforeExpiry.

Create a custom EventBridge rule and AWS Config rule

Prerequisite: If you don't have an Amazon SNS topic, then create a topic. 

Use a custom event pattern with an EventBridge rule to match the acm-certificate-expiration-check AWS Config managed rule. Then, route the response to an Amazon SNS topic. The Amazon SNS topic must be in the same AWS Region as your AWS Config service.

Note: When you use AWS Config, you incur charges. For more information, see AWS Config pricing. 

Create the EventBridge rule

Complete the following steps:

1. Open the EventBridge console.

2. Choose Rules, and then choose Create rule.

3. For Name, enter a name for your rule.

4. For Rule type, choose Rule with and event pattern, and then choose Next.

5. For Event source, choose AWS events or EventBridge partner events.

6. For Event pattern, choose Custom patterns (JSON editor).

7. In the Event pattern preview pane, enter the following event pattern:

   {  "source": [    "aws.config"
     ],
     "detail-type": [
       "Config Rules Compliance Change"
     ],
     "detail": {
       "messageType": [
         "ComplianceChangeNotification"
       ],
       "configRuleName": [
         "acm-certificate-expiration-check"
       ],
       "resourceType": [
         "AWS::ACM::Certificate"
       ],
       "newEvaluationResult": {
         "complianceType": [
           "NON_COMPLIANT"
         ]
       }
     }
   }

8. Choose Next.

9. For Select a target, choose SNS topic.

10. For Topic, select your SNS topic.

11. In the Configure target input dropdown list, choose Input transformer.

12. Choose Configure input transformer.

13. In the Input path text box, enter the following path:

    {  "awsRegion": "$.detail.awsRegion",  "resourceId": "$.detail.resourceId",
      "awsAccountId": "$.detail.awsAccountId",
      "compliance": "$.detail.newEvaluationResult.complianceType",
      "rule": "$.detail.configRuleName",
      "time": "$.detail.newEvaluationResult.resultRecordedTime",
      "resourceType": "$.detail.resourceType"
    }

14. In the Template text box, enter the following template:

    "On example_time AWS Config rule example_rule evaluated the example_resourceType with Id example_resourceId in the account example_awsAccountId region example_awsRegion as example_compliancetype.""For more details open the AWS Config console at https://console.aws.amazon.com/config/home?region=awsRegion#/timeline/resourceType/resourceId/configuration."

    Note: Replace the example values with your values.

15. Choose Confirm, and then choose Next.

16. Choose Next again, and then choose Create rule.

If ACM activates an event type, then you receive an SNS email notification.

Create the AWS Config rule

To create the AWS Config rule, complete the following steps:

1. Open the AWS Config console.
2. In the navigation pane, choose Rules, and then choose Add rule.
3. In Select rule type, choose Add AWS managed rule.
4. For AWS Managed Rules, choose acm-certificate-expiration-check, and then choose Next.
5. On the Parameters page, for Value, enter the number of days that you want the rule to invoke in the daysToExpiration key.
   Note: If certificates are near the expiration date from the number of days that you enter, then the acm-certificate-expiration-check rule identifies the rule as NON_COMPLIANT.
6. Choose Next, and then choose Add rule.

Create a CloudWatch alarm based on a static threshold

Complete the following steps:

1. Open the CloudWatch console.
2. In the navigation pane, choose Alarms, and then choose All alarms.
3. Choose Create alarm, and then choose Select metric.
4. Choose Certificate Manager, and then choose Certificate Metrics.
5. On the Metrics page, select the metric, and then choose Select metric.
6. On the Specify metric and conditions page, for Statistic, choose Minimum.
7. For Period, choose 1 day.
8. For Whenever DaysToExpiry is..., choose Lower/Equal, and then set than... to the number of days that you want the alarm to run before expiration.
9. Choose Next.
10. For Notification, choose In alarm.
11. For Send a notification to the following SNS topic, choose Select an existing SNS topic, or Create new topic, and then choose Next.
12. Enter an alarm name, choose Next.
13. Choose Create alarm.

For more information, see Create a CloudWatch alarm based on a static threshold.

Related information

Reimport a certificate

Getting started with AWS Certificate Manager certificates

How can I use AWS Config to be notified when an AWS resource is non-compliant?

Security best practices for AWS Config