📝 AWS ACM Certificate Expired 🟢

• Contextual name: 📝 Certificate Expired 🟢
• ID: /ce/ca/aws/acm/certificate-expired
• Located in: 📁 AWS ACM

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY
  • RELIABILITY

Similar Policies

• Cloud Conformity
  • ACM Certificate Expired
• Internal
  • dec-x-689858b5

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-689858b5	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS ACM Certificate
  • 🔌 AWS ACM Certificate - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that all expired Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates in AWS Certificate Manager (ACM) are removed. AWS Certificate Manager is a service that allows easy provisioning, management, and deployment of SSL/TLS certificates for use with other Amazon services like Elastic Load Balancing (ELB) and CloudFront.

Rationale

Removing expired certificates enhances security and helps maintain compliance with Amazon's Security Best Practices. Expired certificates may expose sensitive data to interception by malicious actors, posing security and credibility risks. By removing these certificates, organizations mitigate the risk of accidentally deploying invalid SSL/TLS certificates to resources such as Elastic Load Balancing (ELB), which could lead to front-end errors for web applications or websites reliant on ELB and might be perceived as a lack of maintenance or security awareness.

Audit

This policy will mark a certificate as INCOMPLIANT if the Status field is set to EXPIRED.

... see more

Remediation

Open File

Remediation

From Command Line

Perform one of the following commands to request a new managed certificate, import a new externally obtained certificate, or remove the expired ACM certificate via the AWS CLI:

Request a new public certificate

aws acm request-certificate \
--domain-name {{www.example.com}} \
--key-algorithm {{RSA_2048}} \
--validation-method {{DNS}} \
--idempotency-token {{1234}} \
--options CertificateTransparencyLoggingPreference=DISABLED

Note: If you are requesting a public certificate, each domain name that you specify must be validated to verify that you own or control the domain.

Request a new private certificate

aws acm request-certificate \
--domain-name {{www.example.com}} \
--idempotency-token {{12563}} \
--certificate-authority-arn {{certificateAuthorityArn}}

Note: If you do not provide a {{certificateAuthorityArn}} and you are trying to request a private certificate, ACM will attempt to issue a public certificate.

Import a new certificate

aws acm import-certificate \

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 4 Cryptographic key management refers to the generation, distribution, storage, renewal, revocation, recovery, archiving and destruction of encryption keys. Effective cryptographic key management ensures that controls are in place to reduce the risk of compromise of the security of cryptographic keys. Any compromise of the security of cryptographic keys could, in turn, lead to a compromise of the security of the information assets protected by the cryptographic technique deployed.		6	7
💼 APRA CPG 234 → 💼 44c loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.		8	10
💼 Cloudaware Framework → 💼 Expiration Management			12
💼 NIST SP 800-53 Revision 4 → 💼 SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES		2	2