How to Notify Before an Imported ACM Certificate Expires?

Why Option D Is Correct

The key detail in the question is that the certificates are imported from a third-party provider into AWS Certificate Manager (ACM). ACM treats ACM-issued and ACM-imported certificates differently when it comes to expiration notifications:

• ACM-issued certificates are fully managed by AWS, including automatic renewal. For these, ACM emits the ACM Certificate Approaching Expiration event to Amazon EventBridge, typically 60 days before expiration.
• ACM-imported certificates are not managed by ACM. AWS does not renew them, and — critically — ACM does not emit the Approaching Expiration event for them.

Because the company uses imported certificates, Option A cannot work. The correct approach is to use AWS Config with the managed rule acm-certificate-expiration-check. This rule evaluates whether ACM certificates (including imported ones) will expire within a configurable number of days (default is 90). When a certificate becomes non-compliant, AWS Config emits a Config Rules Compliance Change event, which can be captured by an Amazon EventBridge rule and forwarded to the existing SNS topic subscribed by the security team.

Why Option A Is Wrong

Option A looks elegant and is the reason ~40% of the community chooses it. However, the ACM Certificate Approaching Expiration EventBridge event is only generated for certificates issued by ACM. Imported certificates never trigger this event, so the SNS topic would never receive a notification. This is a classic exam trap that rewards reading the question carefully.

Why Option B Is Wrong

Option B proposes a custom Lambda function that periodically scans certificates. While technically feasible, it is:

• Inefficient — it requires you to build, schedule, and maintain custom polling logic.
• Not event-driven — you must manage scheduling (e.g., EventBridge rule invoking Lambda every 24 hours) and implement the expiration-date comparison yourself.
• Redundant — AWS Config already provides a managed rule that does exactly this evaluation.

AWS best practices favor managed services (AWS Config) over custom polling for compliance-style checks.

Why Option C Is Wrong

Option C relies on AWS CloudTrail to emit certificate expiration notifications. CloudTrail logs API activity (e.g., ImportCertificate, RequestCertificate), not certificate lifecycle events like expiration. There is no CloudTrail event for "a certificate is about to expire," so a Step Functions workflow triggered by CloudTrail cannot work for this use case.

Community Consensus

The community is split (D: 60%, A: 40%), but the comments from experienced candidates clearly confirm that the Approaching Expiration event is not emitted for imported certificates, which eliminates Option A and makes Option D the only correct, AWS-recommended solution.