📝 AWS ACM Certificate with Wildcard Domain Name 🟢

• Contextual name: 📝 Certificate with Wildcard Domain Name 🟢
• ID: /ce/ca/aws/acm/certificate-with-wildcard-domain-name
• Located in: 📁 AWS ACM

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Internal
  • dec-x-d25f7dfa

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-d25f7dfa	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS ACM Certificate
  • 🔌 AWS ACM Certificate - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure to use AWS ACM single domain name certificates rather than wildcard certificates. Single domain certificates provide a unique private key for each domain or subdomain, which improves security by limiting the impact of any potential compromise.

Rationale

Wildcard certificates can match any first-level subdomain, including those that may not be actively managed or monitored. This broad coverage can create vulnerabilities; if the private key for a wildcard certificate is compromised, all subdomains using that certificate could be at risk, leading to a potential breach of sensitive data or services. Additionally, the complexity of managing wildcard certificates can result in operational challenges, especially in larger environments.

By employing single domain name certificates, organizations can minimize their attack surface and improve security posture. This strategy also allows for more granular control and management of certificates, making it easier to revoke or update individual certificates as needed without affecting all subdomains under a wildcard certificate.

... see more

Remediation

Open File

Remediation

From Command Line

Perform the following command to remove the wildcard certificate:

aws acm delete-certificate --certificate-arn {{certificateARN}}

Replace {{certificateARN}} with the ARN of the wildcard certificate you want to remove.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 Cloudaware Framework → 💼 Cryptographic Configuration			8
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27