How to Notify the Security Team 90 Days Before an Imported ACM Certificate Expires?

A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications. A developer must implement a solution to notify the company’s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notification Service (Amazon SNS) topic that has the security team’s email address as a subscriber. Which solution will provide the security team with the required notification about certificates?

Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule’s target. Source Reference Answer
Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
Create an AWS Step Functions workflow that is invoked by each certificate’s expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
Configure AWS Config with the acm-certificate-expiration-check managed rule to run every 24 hours. Create an Amazon EventBridge rule that includes an event pattern that specifies the Config Rules Compliance Change detail type and the configured rule. Set the SNS topic as the EventBridge rule’s target.

Community Votes

71%

29%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests whether you know that ACM's built-in expiration events are not configurable to a 90-day lead time, whereas an AWS Config managed rule can be set with daysToExpiration=90 and emit compliance-change events to notify via SNS.

When imported ACM certificates need to trigger a 90-day expiration alert, the reliable solution is to use the AWS Config acm-certificate-expiration-check managed rule with EventBridge and SNS. While the ACM Certificate Approaching Expiration event is popular, it cannot be customised to a 90-day threshold for imported third-party certificates.

Choosing Option A because 'ACM Certificate Approaching Expiration' sounds ideal; however, this event has a fixed, AWS-defined expiration window and is not a substitute for a configurable 90-day custom check.

Community Discussion (4 comments)

0bdf3af 👍 1 Selected: A

Manage certificate expiration events An Amazon EventBridge event will be published when your certificates near expiration. You can configure the "days to expiration" value when these events are first published for your certificates. ACM automatically attempts to renew an ACM generated certificate 60 days prior to certificate expiration. Hence, these events only show up for certificates that have not yet been, or could not be, renewed. Events are published for both issued and imported certificates. For example, when set to 45, the first event will be published when a certificate is 45 days away from its expiration date, followed by one event per day until expiration.

e886835 👍 2 Selected: A

Amazon EventBridge can be used to track specific events, such as the approaching expiration of SSL certificates in AWS Certificate Manager (ACM). AWS publishes events like ACM Certificate Approaching Expiration to EventBridge, which allows you to trigger specific actions when such events occur.

Arad 👍 2 Selected: D

D is the correct answer. Both options A and D are viable solutions for monitoring certificate expirations. Option A leverages ACM's built-in event for certificates approaching expiration, while Option D uses AWS Config's managed rule acm-certificate-expiration-check to assess certificate compliance and trigger notifications via EventBridge and SNS. By default, ACM's "Certificate Approaching Expiration" event starts 45 days before expiration. If you require notifications earlier than 45 days, AWS Config's managed rule allows you to specify a custom number of days for the check. https://docs.aws.amazon.com/acm/latest/APIReference/API_ExpiryEventsConfiguration.html?utm_source=chatgpt.com Question is asking for 90 days earlier than expiration, so D is the right answer.

bp07 👍 2 Selected: A

Amazon EventBridge provides a set of predefined events, and one of these events is related to ACM certificates. Specifically, there is an event type called ACM Certificate Approaching Expiration, which is emitted when an ACM certificate is approaching expiration.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option D is correct because it uses the AWS Config managed rule acm-certificate-expiration-check, which accepts a daysToExpiration parameter that can be set to 90 days for all certificates in ACM, including imported certificates. When the rule evaluates certificates and finds one approaching expiration within that threshold, it produces a compliance change event that EventBridge can match. The EventBridge rule then routes the Config Rules Compliance Change event to the existing SNS topic, which emails the security team. This fully satisfies the requirement for a 90-day notification.

Why the Other Options Are Wrong

Option A is a common trap: ACM does publish ACM Certificate Approaching Expiration events to EventBridge, but the event is emitted at AWS's fixed default interval (often 45-60 days), not a configurable 90-day deadline, and it is not designed for third-party certificates that need custom renewal reminders. Option B sends messages to the SQS queue, but the requirement is to notify the security team through SNS, and there is no poller that forwards from SQS to SNS. Option C incorrectly relies on CloudTrail expiration notifications, which do not exist, and also sends to SQS instead of SNS.

Community Comment Notes

One comment correctly points out that both A and D are viable solutions, but then explains why D is more accurate because the Config rule can be configured for a custom number of days. Other comments favour A by quoting that ACM has an ACM Certificate Approaching Expiration event, but they overlook the fact that the event's timing is not user-configurable. The key takeaway from community discussion is that the phrase '90 days before' should steer you toward a parameterisable AWS Config rule rather than a fixed EventBridge event.

Official Reference

Exam Strategy

Remember that customisable time windows (e.g. '90 days before') are a strong signal to use an AWS Config managed rule with a parameter like daysToExpiration, not a pre-defined EventBridge event. Read the question for explicit timing requirements: ACM and EventBridge events have fixed default thresholds, while AWS Config can be evaluated on a schedule and configured for your exact number of days.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide