How Can You Get 30-Day Notice Before Imported ACM Certificate Expiry?

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

B Use the AWS Config acm-certificate-expiration-check rule to flag imported ACM certificates expiring within 30 days and send SNS alerts via EventBridge.

Question

A company hosts its web applications in the AWS Cloud. The company configures Elastic Load Balancers to use certificates that are imported into AWS Certificate Manager (ACM). The company's security team must be notified 30 days before the expiration of each certificate.
What should a solutions architect recommend to meet this requirement?
  1. Add a rule in ACM to publish a custom message to an Amazon Simple Notification Service (Amazon SNS) topic every day, beginning 30 days before any certificate will expire.
  2. Create an AWS Config rule that checks for certificates that will expire within 30 days. Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a noncompliant resource. Correct Answer
  3. Use AWS Trusted Advisor to check for certificates that will expire within 30 days. Create an Amazon CloudWatch alarm that is based on Trusted Advisor metrics for check status changes. Configure the alarm to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS).
  4. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that will expire within 30 days. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS).

Key Takeaways

The question tests how to detect imported ACM certificates before expiry, and the trap is treating EventBridge as a date-based detector or assuming Trusted Advisor is universally available.

Imported ACM certificates do not renew automatically, so the security team needs a reliable expiry notification mechanism. This page establishes that AWS Config's acm-certificate-expiration-check rule with EventBridge and SNS is the correct SAA-C03 answer for 30-day advance alerts.

Common mistake: Most learners pick D because EventBridge can receive ACM approaching-expiration events, but option D's rule cannot itself detect a 30-day window and omits the AWS Config managed rule that performs that evaluation.

Expert Analysis

Why the Answer Is Correct

Option B matches AWS's documented pattern for ACM certificate expiration notifications: the AWS Config managed rule acm-certificate-expiration-check evaluates ACM certificates against a configurable expiration threshold such as 30 days. Imported certificates in ACM are not auto-renewed, so Config can flag them as noncompliant when they enter that window. EventBridge receives the AWS Config compliance-change event and targets an SNS topic for the security team. This gives a repeatable, per-account alerting mechanism without relying on support-plan-gated Trusted Advisor checks.

Why the Other Options Are Wrong

Option A invents an ACM feature: ACM does not let you add a rule that publishes a custom SNS message every day starting 30 days before expiry. Option C uses Trusted Advisor, whose ACM certificate expiration check and CloudWatch metrics are tied to Business or Enterprise Support and are less precise than a Config managed rule. Option D is close but incorrectly says an EventBridge rule can "detect" certificates expiring within 30 days; EventBridge routes events, and the Lambda function would need additional expiry-evaluation logic that the option does not specify. The question asks for the recommended 30-day notification, and AWS Config's acm-certificate-expiration-check is the purpose-built control.

Community Comment Notes

LeGloupier points directly to the managed rule "acm-certificate-expiration-check", which is the strongest technical confirmation for option B. TTaws makes a useful distinction that EventBridge is an event router, not an expiry detector, so option D is worded incorrectly. ChrisG1454 notes that both B and D appear in AWS guidance and says candidates must read them carefully, which is exactly why the Config-based wording wins here. Kaab_B cites the EventBridge-to-Lambda pattern, but that pattern starts from an ACM event rather than an EventBridge rule evaluating a 30-day window; Bayebrymo also observed that the linked article does not require Lambda for option D.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For certificate-expiry questions, first identify whether the certificate is imported, because imported ACM certificates are your responsibility to renew. Then look for the AWS Config managed rule that checks expiration thresholds and an EventBridge-to-SNS notification path; avoid options that assume EventBridge can evaluate dates by itself or that Trusted Advisor is available without a support plan.

Frequently Asked Questions

Why is EventBridge plus Lambda (option D) not the best answer for ACM expiry?

An EventBridge rule routes events; it cannot itself detect certificates expiring within 30 days. AWS Config's acm-certificate-expiration-check performs that evaluation and reports noncompliance for SNS alerting.

Does acm-certificate-expiration-check cover imported ACM certificates?

Yes. The AWS Config managed rule evaluates ACM certificates, including imported ones, and reports noncompliance when they are within the configured expiry threshold; imported certificates are not auto-renewed.

More SAA-C03 FAQ →

Discussion 165 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 165

  1. pentium75 👍 16
    Nobody asked for cost optimization.
  2. ChrisG1454 👍 9
    Answer B and answer D are possible according to this article. So, need to read B & D carefully to determine the most suitable answer. Reference: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
  3. TTaws 👍 9
    Its B, simply because in option D - event bridge cannot "detect" anything.
  4. Kaab_B 👍 8 Answered D
    Correct answer is D. Exact wordings from AWS docs: The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
  5. Bayebrymo 👍 8
    But from the link shared. It doesnt state that you should invoke lambda function as stated in option D. Option B is explicitly stated in the article as also worded in option B. So i think B should be the answer. My thought though. i stand to be corrected.
Show 25 more comments
  1. Mia2009687 👍 5
    B costs more than D To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date. If you use AWS Config for this resolution, then be aware of the following: Before you set up the AWS Config rule, create the Amazon Simple Notification Service (Amazon SNS) topic and EventBridge rule. This makes sure that all non-compliant certificates invoke a notification before the expiration date. Activating AWS Config incurs an additional cost based on usage. For more information, see AWS Config pricing. https://repost.aws/knowledge-center/acm-certificate-expiration
  2. fkie4 👍 5
    All i wanna say is that I really hate this kind of question. The author of the question should have the question reviewed by some AWS experts. if there are 2 answers that are so close, he should consider changing the option, or abandon the question. I bet if all AWS expert on earth try to answer this question, the result will be 50-50
  3. ondan 👍 4 Answered D
    The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS.
  4. pentium75 👍 4 Answered B
    B does exactly match one of the recommended approaches. "Create an AWS Config rule that checks for certificates that will expire within 30 days": https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html "Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a noncompliant resource": https://repost.aws/knowledge-center/config-resource-non-compliant
  5. darekw 👍 4
    AWS Certificate Manager (ACM) now publishes certificate metrics and events through Amazon CloudWatch and Amazon EventBridge. https://aws.amazon.com/about-aws/whats-new/2021/03/aws-certificate-manager-provides-certificate-expiry-monitoring-through-amazon-cloudwatch/
  6. NSA_Poker 👍 3 Answered B
    The correct answer is B bc: (LeGloupier has a popular post on this) https://repost.aws/knowledge-center/acm-certificate-expiration#:~:text=To%20get%20a%20notification%20that%20your%20certificate%20is%20about%20to%20expire%2C%20use%20one%20of%20the%20following%20methods%3A D IS INCORRECT bc: -Lambda is not necessary; AWS services (such as Amazon EC2, Amazon S3 & Amazon CloudWatch) can publish messages to your SNS topics to trigger event-driven computing and workflows. Using Lambda here goes against building the Well-Architected Framework pillar of Performance Efficiency. The more efficient solution is to use the managed service of AWS Config. -For those that argue against (B) bc of cost: The Cost Optimization pillar is upheld by (B) vs (D). Understanding how efficient your current architecture is in relation to your goals can remove unneeded expense. The goal is for the security team to be notified B4 expiration. If the certificate expires, there will be a far greater expense to pay.
  7. EA100 👍 3
    ANSWER - D Here are the steps to set this up: Request or import the SSL/TLS certificate into ACM and attach it to the Elastic Load Balancers. Create a new CloudWatch Events rule with a schedule expression that matches the certificate expiration date. For example, if the certificate expires on May 31, 2023, the schedule expression should be: cron(0 0 31 4 ? 2023). Choose a target for the CloudWatch Events rule, such as an Amazon SNS topic or an AWS Lambda function. Configure the notification message to include information about the expiring certificate, such as its domain name, ACM certificate ID, and expiration date. Test the CloudWatch Events rule by simulating an expired certificate. By using ACM to manage the certificates and CloudWatch Events to trigger the notifications, the company can ensure that the security team is notified 30 days before the certificate expiration date, and can take appropriate actions to renew or replace the certificate in a timely manner.
  8. Buruguduystunstugudunstuy 👍 3 Answered D
    CORRECT Option D is the best answer because it involves using Amazon EventBridge (formerly known as Amazon CloudWatch Events), which is a fully managed event bus that makes it easy to set up and run event-driven applications. You can use EventBridge to create rules that trigger based on the occurrence of an event, such as the expiration of a certificate. By creating a rule that detects any certificates that will expire within 30 days, you can ensure that the security team is notified in a timely manner. In addition, Option D involves using an AWS Lambda function, which is a compute service that lets you run code without provisioning or managing servers. You can configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when it is triggered by the EventBridge rule. This allows you to automate the process of sending notifications to the security team.
  9. Tjazz04 👍 3 Answered B
    Based on Copilot: Here's a summary of why Option B is the best choice for notifying the security team about expiring certificates: AWS Config: Continuously monitors and evaluates the compliance of AWS resources, including ACM certificates. EventBridge Integration: Automatically triggers alerts when AWS Config detects a noncompliant resource, such as an expiring certificate. Amazon SNS: Sends notifications to the security team, ensuring timely alerts 30 days before expiration. Option B is more integrated, reliable, and easier to manage compared to Options C and D, which involve more complexity and maintenance.
  10. Buruguduystunstugudunstuy 👍 3
    WRONG Option A is not a viable solution because it would involve sending a daily message to the Amazon SNS topic, which would not be necessary or efficient. Option B is not the best choice because it involves using AWS Config, which is designed for monitoring and recording resource configurations. It is not well suited for monitoring the expiration of certificates. Option C is not a good fit because it involves using AWS Trusted Advisor, which is a tool that helps you optimize your AWS resources. It is not designed for monitoring the expiration of certificates.
  11. MiteshB 👍 3 Answered D
    Option D is the correct solution to meet the requirement. By creating an Amazon EventBridge rule, the solution can monitor the certificates hosted on the Elastic Load Balancer for any that are about to expire within 30 days. When a certificate meets this criteria, the rule triggers an AWS Lambda function that sends an email alert to the security team using Amazon SNS. This approach is the most efficient and targeted solution to meet the requirement as it only notifies the security team when a certificate is about to expire, reducing unnecessary notifications.
  12. PaulGa 👍 3 Answered D
    Ans D - I must admit it wasn't clear until I read... "zhaoxiaobing101" (1 week, 5 days ago): "AWS Config is primarily designed for compliance monitoring rather than straightforward event detection like certificate expiration. It requires setting up compliance rules and monitoring them, which adds complexity. By focusing directly on the task at hand, D minimizes operational overhead and simplifies the architecture, making it the better choice for the specific requirement of monitoring and alerting on certificate expiration."
  13. pentium75 👍 3
    D sounds plausible, but a) the wording is wrong ("EventBridge ... rule to detect"). EventBridge can be invoked by ACM but it cannot "detect" anything b) There's no reason to invoke a Lambda function. EventBridge would send an alert via SNS; it doesn't make sense for EventBridge to invoke a Lambda function that sends an alert via SNS https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html
  14. awsgeek75 👍 3 Answered B
    https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html B is correct as AWS Config is exactly for this. A: cannot be done without using CloudWatch (basically D) C: Trusted Advisor is not for this, it's for performance improvements D: Why do you need a custom alert?
  15. Ikki77 👍 3 Answered B
    This option involves using AWS Config to assess the compliance of resources (certificates) and triggering an alert through Amazon EventBridge and Amazon SNS when a noncompliant resource is detected. It provides a proactive and automated approach to monitor certificate expirations.
  16. Risin42 👍 3 Answered B
    D is incorrect because EventBridge can only detect certificates that have already expired, not those that will expire within 30 days. Also, using a Lambda function to send an alert via SNS is unnecessary and adds complexity to the solution.
  17. RupeC 👍 3
    My understanding is that the ACM sends a Cert Expiration event to EventBridge. Thus EB. does not need to detect anything.
  18. Penjerla 👍 3 Answered B
    Another reason it is not D. EventBridge event can by itself publish to SNS without invoking a lambda function
  19. ashish_t 👍 3 Answered B
    I think, For SAA-C02: D But for SAA-C03: B
  20. FNJ1111 👍 2 Answered D
    This is from an AWS blog post in May 2021; AWS Config may have added the service, but assuming this question is from May 2021 time, the answer is D. "The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS." https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
  21. Uzbekistan 👍 2 Answered D
    Amazon EventBridge Rule: Set up a rule in Amazon EventBridge (formerly CloudWatch Events) to monitor for certificates nearing expiration. You can configure this rule to trigger actions based on certain events. AWS Lambda Function: Upon detection of certificates that will expire within 30 days, configure the EventBridge rule to invoke an AWS Lambda function. Lambda functions are ideal for executing custom logic in response to events. Lambda Function to Send Alert: In the Lambda function, implement the logic to send a custom alert via Amazon SNS. SNS is a messaging service that can send notifications to various endpoints, including email, SMS, or other AWS services. This ensures that the security team receives timely notifications regarding certificate expirations.
  22. iamroyalty_k 👍 2 Answered D
    Why Option D is Correct? ✅ EventBridge can trigger an alert when an ACM certificate is about to expire. ✅ Lambda can process the event and send a notification through Amazon SNS to notify the security team. ✅ SNS ensures the notifications are delivered via email, SMS, or other means based on the team's preference. ✅ This is an automated, scalable, and AWS-native solution. Why Not the Other Options? A - ❌ ACM does not support custom rules or direct SNS integration for expiring certificates. B - ❌ AWS Config does not have a built-in rule to check ACM certificate expiration. Creating a custom rule would add unnecessary complexity. C - ❌ Trusted Advisor does not check ACM certificates for expiration. It only monitors IAM certificate expiration.
  23. Joxtat 👍 2 Answered D
    Solution overview This solution provides a Lambda function that makes use of CloudWatch rules to report back those certificates that are due to expire within a pre-defined amount of time. The Lambda function is written to respond to CloudWatch events in two ways. When the event is time-based, the function looks for all certificates that have a DaysToExpiry metric. When the event is based on an event that is raised from a specific certificate, the function examines the single certificate. In both cases, the function logs the findings to Security Hub and sends out an SNS notification. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
  24. sidharthwader 👍 2
    https://aws.amazon.com/certificate-manager/faqs/ This AWS document says: Imported certificates – If you want to use a third-party certificate with Amazon CloudFront, Elastic Load Balancing, or Amazon API Gateway, you may import it into ACM using the AWS Management Console, AWS CLI, or ACM APIs. ACM can not renew imported certificates, but it can help you manage the renewal process. You are responsible for monitoring the expiration date of your imported certificates and for renewing them before they expire. You can use ACM CloudWatch metrics to monitor the expiration dates of an imported certificates and import a new third-party certificate to replace an expiring one.
  25. gx2222 👍 2 Answered D
    Option D is the best solution because it recommends using Amazon EventBridge to detect any certificates that will expire within 30 days. Amazon EventBridge provides a simple and scalable way to capture and route events from AWS services and third-party SaaS applications. In this case, an Amazon CloudWatch Events rule can be created to capture certificate expiration events, which will then trigger an AWS Lambda function. The Lambda function can be configured to send a custom alert through Amazon SNS to the security team. This solution is efficient, scalable, and addresses the requirement of notifying the security team 30 days before the certificate expiration.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide