To control the usage of Certificate in AWS

Here is official AWS documentation about best practices when using Amazon Certificate Manager

Including:

Set up certificate expiration alerts: AWS services like ACM and ACM PCA can send expiration alerts via email or SNS topic when a certificate is about to expire. You can also use CloudWatch Events to set up custom alerts based on specific criteria, such as a certain percentage of certificates expiring within a given time period.

Use AWS Config: AWS Config is a fully managed service that provides a detailed inventory of your AWS resources, including certificates. You can use AWS Config to track certificate usage and changes, and you can set up rules to monitor changes to certificate attributes.

Enable AWS CloudTrail: AWS CloudTrail is a service that enables you to log, continuously monitor, and retain account activity related to AWS resources and services, including certificate management. You can use CloudTrail to monitor certificate activity, identify changes to certificate attributes, and troubleshoot issues.

Use AWS Identity and Access Management (IAM) to manage access: IAM enables you to manage access to AWS services and resources, including certificates. You can use IAM to create roles and policies that restrict access to specific users or groups, and you can use IAM to enforce multi-factor authentication for certificate management operations.