How Can You Get 30-Day Notice Before Imported ACM Certificate Expiry?
Answer
Correct answer: B — Use the AWS Config acm-certificate-expiration-check rule to flag imported ACM certificates expiring within 30 days and send SNS alerts via EventBridge.
A company hosts its web applications in the AWS Cloud. The company configures Elastic Load Balancers to use certificates that are imported into AWS Certificate Manager (ACM). The company's security team must be notified 30 days before the expiration of each certificate. What should a solutions architect recommend to meet this requirement?
Community Insight
The question tests how to detect imported ACM certificates before expiry, and the trap is treating EventBridge as a date-based detector or assuming Trusted Advisor is universally available.
Imported ACM certificates do not renew automatically, so the security team needs a reliable expiry notification mechanism. This page establishes that AWS Config's acm-certificate-expiration-check rule with EventBridge and SNS is the correct SAA-C03 answer for 30-day advance alerts.
Most learners pick D because EventBridge can receive ACM approaching-expiration events, but option D's rule cannot itself detect a 30-day window and omits the AWS Config managed rule that performs that evaluation.
Community Discussion (175 comments)
parfait101
👍 1
Selected: C
AWS Trusted Advisor + CloudWatch Alarm + SNS since the certificate is imported not AWS managed.
ln2718
👍 2
Selected: B
Breaking the tie with Chat AI (even rhymes)) - Use the managed AWS Config rule acm-certificate-expiration-check with daysToExpiration = 30. When the rule flags a noncompliant certificate, have EventBridge trigger an SNS notification to the security team.
OrLe
👍 1
Selected: B
aws config provide a managed rule
caca783
👍 2
Selected: B
AWS Config provides a managed rule called acm-certificate-expiration-check. This rule checks if ACM certificates in your account are marked for expiration within a specified number of days (default is 30 days)
kaleido
👍 2
Selected: D
I chose option D. Option B works, but is recommended for beyond 45 days.
Charlesvg
👍 2
Selected: D
i asked ChatGPT about the best between B & D It said D because eventBridge is natively connected with ACM whereas AWS Config does not natively support certificates expiration
sagarvh
👍 2
Selected: D
Answer is D
network_enthusiast
👍 1
Selected: D
Amazon Event Bridge can detect certificate expiry event for certificate managed by ACM.
dattateja8
👍 1
Selected: B
B AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
dattateja8
👍 1
Selected: D
AWS Config does not have in-built feature to check certificate expiry and it has to use out of the box managed rule to check like AWS Lambda. In Answer B it is not mentioned to use AWS Lambda. So the best option here is D.
gigilla
👍 1
Selected: B
B AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
kg508
👍 1
Selected: D
B와 헷갈렸는데, 알림에 대한 구체적인 방법이 D에 있어 이것으로 선택했습니다 eventbridge만으로는 보안팀에게 알림을 전달하기에 부족하다고 생각합니다
iamroyalty_k
👍 2
Selected: D
Why Option D is Correct? ✅ EventBridge can trigger an alert when an ACM certificate is about to expire. ✅ Lambda can process the event and send a notification through Amazon SNS to notify the security team. ✅ SNS ensures the notifications are delivered via email, SMS, or other means based on the team's preference. ✅ This is an automated, scalable, and AWS-native solution. Why Not the Other Options? A - ❌ ACM does not support custom rules or direct SNS integration for expiring certificates. B - ❌ AWS Config does not have a built-in rule to check ACM certificate expiration. Creating a custom rule would add unnecessary complexity. C - ❌ Trusted Advisor does not check ACM certificates for expiration. It only monitors IAM certificate expiration.
Dharmarajan
👍 1
Selected: B
B or D both will work. Per the documentation: To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are near the expiration date. Use AWS Config to check for certificates that are near the expiration date. Create an Amazon CloudWatch alarm based on a static threshold when certificates are near the expiration date.
itsmeDiyan
👍 1
Selected: D
Use EventBridge, Lambda, and SNS
zdi561
👍 1
Selected: C
Based on this article it is C if the notification is within 45 days, otherwise use B https://repost.aws/knowledge-center/acm-certificate-expiration
iagotb
👍 1
Selected: B
Correct answer is B. Based on https://repost.aws/knowledge-center/acm-certificate-expiration D is not valid because by default AWS Config will send ACM Certificate Approaching Expiration event at 45 days. Question asks for 30 days so then we will need to: After you create the rule, you can change the timing of the expiration notification. In the ACM API's PutAccountConfiguration action, enter a value between 1-45 for DaysBeforeExpiry. As D answer doesn't say that is not valid. In the other hand, answer B is completely valid.
FlyingHawk
👍 1
Selected: D
Based on this article, D is a better solution. reasons: - AWS Config has charges - AWS cofig can only be configured for the day, so D will be more real time.
d8
👍 1
Selected: D
Option D: Fully automated and customizable solution. Real-time monitoring and notifications. Scalable and cost-efficient.
AshishDhole
👍 1
Selected: B
Answer Should be : B Create a custom EventBridge rule to receive email notifications when certificates are near the expiration date. Use AWS Config to check for certificates that are near the expiration date. Create an Amazon CloudWatch alarm based on a static threshold when certificates are near the expiration date
ricktechie66
👍 1
Selected: D
D is incorrect because EventBridge alone cannot directly detect certificate expiration - it needs to work with another service (like AWS Config) to get this information
rindatta
👍 2
No, EventBridge can do that alone with configuring the "ACM Certificate Approaching Expiration" event in EventBridge. Ceck the below link: https://repost.aws/knowledge-center/acm-certificate-expiration
hashepsut
👍 1
Selected: D
Option D provides a straightforward, reliable, and customizable solution that directly addresses the requirement of notifying the security team 30 days before certificate expiration.
hilker1983
👍 1
Selected: D
Option D provides a reliable, automated, and straightforward solution that directly integrates ACM events, EventBridge, Lambda, and SNS for timely notifications.
dipenich
👍 1
Selected: D
EventBridge for Monitoring Expiration: EventBridge can detect certificate expiration events in ACM automatically, including those 30 days before expiration. Custom Notifications via Lambda and SNS: A Lambda function processes the detected event and formats a custom alert. This alert is sent through Amazon SNS to notify the security team.
Tjazz04
👍 3
Selected: B
Based on Copilot: Here's a summary of why Option B is the best choice for notifying the security team about expiring certificates: AWS Config: Continuously monitors and evaluates the compliance of AWS resources, including ACM certificates. EventBridge Integration: Automatically triggers alerts when AWS Config detects a noncompliant resource, such as an expiring certificate. Amazon SNS: Sends notifications to the security team, ensuring timely alerts 30 days before expiration. Option B is more integrated, reliable, and easier to manage compared to Options C and D, which involve more complexity and maintenance.
Penjerla
👍 3
Selected: B
Another reason it is not D. EventBridge event can by itself publish to SNS without invoking a lambda function
EllenLiu
👍 1
Selected: B
AWS config has a build-in rule 'acm-certificate-expiration-check' which can be used to Checks whether ACM Certificates in your account are marked for expiration within the specified number of days. Certificates provided by ACM are automatically renewed. ACM does not automatically renew certificates that you import.
Carlini2020
👍 1
Selected: D
D is the one
gebre.2006.refael
👍 1
D- because it notified 30 days BEFORE the expiration of each certificate
ondan
👍 4
Selected: D
The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS.
Tsige
👍 1
Answer is D. Operational Overhead: Using AWS Config for this purpose might add unnecessary operational overhead, as it involves additional configuration and management steps compared to a more direct EventBridge and Lambda setup.
aturret
👍 1
Selected: D
D
tonybuivannghia
👍 1
Selected: B
I think B is correct
PaulGa
👍 3
Selected: D
Ans D - I must admit it wasn't clear until I read... "zhaoxiaobing101" (1 week, 5 days ago): "AWS Config is primarily designed for compliance monitoring rather than straightforward event detection like certificate expiration. It requires setting up compliance rules and monitoring them, which adds complexity. By focusing directly on the task at hand, D minimizes operational overhead and simplifies the architecture, making it the better choice for the specific requirement of monitoring and alerting on certificate expiration."
zhaoxiaobing101
👍 1
Selected: D
AWS Config is primarily designed for compliance monitoring rather than straightforward event detection like certificate expiration. It requires setting up compliance rules and monitoring them, which adds complexity. By focusing directly on the task at hand, D minimizes operational overhead and simplifies the architecture, making it the better choice for the specific requirement of monitoring and alerting on certificate expiration.
rpmaws
👍 1
Selected: D
AWS config dont have capacity to check expiration
xekiva3329
👍 2
Selected: D
D https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
jatric
👍 1
Selected: B
AWS config rule to check the certificate expiry and with Event bridge to invoke an event to notify if certificate going to expiry
mknarula
👍 1
Selected: B
You would need event bridge to invoke lambda. That is missing in the option D
Manjeet_Kumar
👍 1
D Not B because AWS Config is more suitable for monitoring configuration compliance rather than tracking the expiry of certificates. Setting up an AWS Config rule specifically for certificate expiration would be complex and less efficient compared to using EventBridge.
yach94
👍 2
Selected: D
The answer is D because: If you want to set up notifications for more than 45 days before an event's expiration, then use the alternative following methods. Create a custom EventBridge rule Use a custom event pattern with an EventBridge rule to match the AWS Config managed rule acm-certificate-expiration-check. Then, route the response to an Amazon Simple Notification Service topic. So if you want to be notified 30 days before expiration, you wont use aws config. Link: https://repost.aws/knowledge-center/acm-certificate-expiration
NSA_Poker
👍 3
Selected: B
The correct answer is B bc: (LeGloupier has a popular post on this) https://repost.aws/knowledge-center/acm-certificate-expiration#:~:text=To%20get%20a%20notification%20that%20your%20certificate%20is%20about%20to%20expire%2C%20use%20one%20of%20the%20following%20methods%3A D IS INCORRECT bc: -Lambda is not necessary; AWS services (such as Amazon EC2, Amazon S3 & Amazon CloudWatch) can publish messages to your SNS topics to trigger event-driven computing and workflows. Using Lambda here goes against building the Well-Architected Framework pillar of Performance Efficiency. The more efficient solution is to use the managed service of AWS Config. -For those that argue against (B) bc of cost: The Cost Optimization pillar is upheld by (B) vs (D). Understanding how efficient your current architecture is in relation to your goals can remove unneeded expense. The goal is for the security team to be notified B4 expiration. If the certificate expires, there will be a far greater expense to pay.
Omar_yousry10
👍 2
Selected: B
AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
824c449
👍 2
Selected: C
C: AWS Trusted Advisor, which provides a check for ACM certificates nearing expiration among its other best practice checks. When Trusted Advisor detects a certificate nearing its expiration (typically within 30 days), its status change can trigger an Amazon CloudWatch alarm if integrated. This alarm, when set up accordingly, can be configured to notify an SNS topic, which in turn can send a custom alert to notify the security team. This approach leverages AWS services without requiring custom scripting or manual checks.
Solomon2001
👍 1
Selected: D
Amazon EventBridge (Amazon CloudWatch Events) can be used to detect any certificates that will expire within 30 days. An EventBridge rule can be configured to trigger an AWS Lambda function. The Lambda function can send a custom alert using Amazon SNS, notifying the security team about the impending certificate expiration.
soufiyane
👍 1
Selected: D
we should use eventbridge guys common !! no use for config as it's only to detecte rules that have changed
MehulKapadia
👍 1
Selected: D
Answer: D D is correct answer. which is less overhead and doesn't need continuous evaluation(like AWS Config) as its fully based on async events. Option B) - AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates. Note that, continuous monitoring and evaluation of resource configurations against predefined or custom rules, including checking for expiring ACM certificates.
TruthWS
👍 1
B is correct because A,C,D is true but not complete
bhushansathe
👍 1
Selected: D
I think the answer is D as the question is to get a report only for the ACM notification not for the all non-compliant resource
Uzbekistan
👍 2
Selected: D
Amazon EventBridge Rule: Set up a rule in Amazon EventBridge (formerly CloudWatch Events) to monitor for certificates nearing expiration. You can configure this rule to trigger actions based on certain events. AWS Lambda Function: Upon detection of certificates that will expire within 30 days, configure the EventBridge rule to invoke an AWS Lambda function. Lambda functions are ideal for executing custom logic in response to events. Lambda Function to Send Alert: In the Lambda function, implement the logic to send a custom alert via Amazon SNS. SNS is a messaging service that can send notifications to various endpoints, including email, SMS, or other AWS services. This ensures that the security team receives timely notifications regarding certificate expirations.
CloudLearner01
👍 2
Answer: B Refer: https://repost.aws/knowledge-center/acm-certificate-expiration To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date.
sidharthwader
👍 2
https://aws.amazon.com/certificate-manager/faqs/ This AWS document says: Imported certificates – If you want to use a third-party certificate with Amazon CloudFront, Elastic Load Balancing, or Amazon API Gateway, you may import it into ACM using the AWS Management Console, AWS CLI, or ACM APIs. ACM can not renew imported certificates, but it can help you manage the renewal process. You are responsible for monitoring the expiration date of your imported certificates and for renewing them before they expire. You can use ACM CloudWatch metrics to monitor the expiration dates of an imported certificates and import a new third-party certificate to replace an expiring one.
Garen_Lee
👍 1
Selected: D
Refer to the official documents, ACM can use Amazon EventBridge to manage credentials. https://docs.aws.amazon.com/acm/latest/userguide/cloudwatch-metrics.html
Risin42
👍 3
Selected: B
D is incorrect because EventBridge can only detect certificates that have already expired, not those that will expire within 30 days. Also, using a Lambda function to send an alert via SNS is unnecessary and adds complexity to the solution.
Ikki77
👍 3
Selected: B
This option involves using AWS Config to assess the compliance of resources (certificates) and triggering an alert through Amazon EventBridge and Amazon SNS when a noncompliant resource is detected. It provides a proactive and automated approach to monitor certificate expirations.
asdfcdsxdfc
👍 2
Selected: B
I think its B
Parul25
👍 1
I choose B. https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html
psyll0n
👍 1
According to CoPilot (Chat GPT), the correct answer is: The correct answer is B. You can create an AWS Config rule that checks for certificates that will expire within 30 days. Then, you can configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a non-compliant resource. This approach allows you to be notified when a certificate is nearing its expiration date, giving you time to renew it before it expires. Please note that AWS Certificate Manager (ACM) does not automatically renew certificates that you import. Therefore, it’s important to monitor the expiration of these certificates and renew them manually as needed.
psyll0n
👍 2
Here is an example of how you can set up an AWS Config rule to check for certificates that are nearing the expiration date: JSON { "ConfigRuleName": "acm-certificate-expiration-check", "Description": "Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days.", "Scope": { "ComplianceResourceTypes": [ "AWS::ACM::Certificate" ] }, "Source": { "Owner": "AWS", "SourceIdentifier": "ACM_CERTIFICATE_EXPIRATION_CHECK" }, "InputParameters": { "daysToExpiration": "30" } }
thewalker
👍 2
Selected: D
D is the correct answer as per the FAQs : https://aws.amazon.com/certificate-manager/faqs/
lofzee
👍 1
dunno where on that link it says D is correct. correct answer is B bro
xelopelo
👍 2
Selected: B
AWS config has a rule specifically created for checking expiration of acm certificates
Charumathi
👍 1
Selected: B
B is the correct answer, To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date. If you use AWS Config for this resolution, then be aware of the following: Before you set up the AWS Config rule, create the Amazon Simple Notification Service (Amazon SNS) topic and EventBridge rule. This makes sure that all non-compliant certificates invoke a notification before the expiration date. https://repost.aws/knowledge-center/acm-certificate-expiration
awsgeek75
👍 3
Selected: B
https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html B is correct as AWS Config is exactly for this. A: cannot be done without using CloudWatch (basically D) C: Trusted Advisor is not for this, it's for performance improvements D: Why do you need a custom alert?
bujuman
👍 1
Selected: D
For me key words are "are imported into AWS Certificate Manager (ACM)". EnventBridges rules are build on top AWS and partner events and as it can be seen bellow, could smoothly handle certificate expiration events with "DaysToExpiry": parameter,: Event source : AWS events or EventBridge partner events Other All events Sample events: ACM Certificate Appraaching Expiration
pentium75
👍 4
Selected: B
B does exactly match one of the recommended approaches. "Create an AWS Config rule that checks for certificates that will expire within 30 days": https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html "Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a noncompliant resource": https://repost.aws/knowledge-center/config-resource-non-compliant
pentium75
👍 3
D sounds plausible, but a) the wording is wrong ("EventBridge ... rule to detect"). EventBridge can be invoked by ACM but it cannot "detect" anything b) There's no reason to invoke a Lambda function. EventBridge would send an alert via SNS; it doesn't make sense for EventBridge to invoke a Lambda function that sends an alert via SNS https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html
RicardoD
👍 1
Selected: D
This link from AWS explain the process. It is option D https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
awsgeek75
👍 2
Selected: D
My understanding is that ACM can publish an event for certificates that are about to expire. This makes "D" more reasonable option as compared to others. https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html#expiration-approaching-event
JTruong
👍 1
https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/ This blog described steps to answer this question: 1. Use EventBridge 2. Use Lambda from (1) 3. Produce SNS so correct answer is D
pentium75
👍 2
Correct: No, you can make it 30 days. But why the Lambda function? Isn't that quite complex? Stem doesn't ask for cheapest solution.
mrkmtei
👍 2
This can be configured to whatever you need in the Days to expiry box
1Alpha1
👍 2
Selected: B
B - "AWS Config (acm-certificate-expiration-check) --> Eventrbridge --> SNS" Not D - No need of lambda in between Eventbridge & SNS
viru
👍 1
Selected: D
https://repost.aws/knowledge-center/acm-certificate-expiration
RNess
👍 1
Selected: B
acm-certificate-expiration-check
tohegajaf
👍 1
https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html
Shalen
👍 1
Selected: A
the correct answer should be A ACM - Aws Certificate Manager "Maintain SSL/TLS certificates, including certificate renewals, with automated certificate management." see : https://aws.amazon.com/certificate-manager/
pentium75
👍 1
But we want ONE notification "30 days before the expiration", not "every day" as in A.
MrPCarrot
👍 1
The Answer is B......
slots
👍 1
Selected: B
I don't see a reason for custom alert therefore going for B.
xdkonorek2
👍 2
Selected: D
aws config will send event to eventbridge but won't allow for customizing this message, so "custom alert" is not possible D is correct, eventBridge can listen for acm-certificate-expiration-check event
pentium75
👍 1
Doesn't say anything about "custom alert", just the team "must be notified". ACM cert expiration event is 45, not 30, days before expiration.
aptx4869
👍 1
Selected: D
D is correct answer after I read this article. Most cost -efficient option is D.
pentium75
👍 1
But it's 45, not 30, days.
wearrexdzw3123
👍 1
B D is okay, but D is more effective
pentium75
👍 2
Creating custom code and putting it into a Lambda function is more effective than using an existing cloud service?
iwannabeawsgod
👍 1
its B.
Andriy300
👍 1
Selected: B
B Because https://repost.aws/knowledge-center/acm-certificate-expiration
Hibiki761
👍 1
Selected: B
https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html Config is used for expiration detection.
Subhrangsu
👍 1
Why not A? https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html(1st paragraph)
blurtiger320918
👍 1
Selected: D
Tested in AWS account, answer is D
BrijMohan08
👍 1
Selected: B
https://repost.aws/knowledge-center/acm-certificate-expiration
RDM10
👍 1
As per the above link, AWS Config incur additional charges so D is better.
Chiquitabandita
👍 1
I believe it is D based on this article mentioning EventBridge event of a certificate expiring https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html
darekw
👍 1
https://aws.amazon.com/about-aws/whats-new/2021/03/aws-certificate-manager-provides-certificate-expiry-monitoring-through-amazon-cloudwatch/
Hassaoo
👍 1
Option D is a viable solution, but Option B provides a more direct approach by leveraging AWS Config's compliance checking capabilities and integrating with CloudWatch Events and Amazon SNS for streamlined and automated alerting.
TariqKipkemei
👍 1
Selected: B
AWS Config Rule: acm-certificate-expiration-check, Checks if AWS Certificate Manager Certificates in your account are marked for expiration within the specified number of days.
Stevey
👍 1
Vizzini: But it's so simple. All I have to do is divine it from what I know of you. Are you the sort of man who would put the poison into his own goblet or his enemies? Now, a clever man would put the poison into his own goblet because he would know that only a great fool would reach for what he was given. I am not a great fool so I can clearly not choose the wine in front of you...But you must have known I was not a great fool; you would have counted on it, so I can clearly not choose the wine in front of me. Man in black: You've made your decision then? Vizzini: [happily] Not remotely! Because Iocaine comes from Australia. As everyone knows, Australia is entirely peopled with criminals. And criminals are used to having people not trust them, as you are not trusted by me. So, I can clearly not choose the wine in front of you. Man in black: Truly, you have a dizzying intellect.
Sat897
👍 1
Selected: D
AWS Config - Used to check for configuration updates. So D
cookieMr
👍 2
Selected: B
B is correct, least op overhead
yhonatan2288
👍 1
Selected: B
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
slimjago
👍 1
Selected: A
could be A https://aws.amazon.com/es/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
pentium75
👍 2
"ACM sends a Cert Expiration event to EventBridge" yes, but 45 (not 30) days before expiration.
speedt115
👍 1
B is correct, same crosschecked with DOC
Kaab_B
👍 8
Selected: D
Correct answer is D. Exact wordings from AWS docs: The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
diabloexodia
👍 1
To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date. https://repost.aws/knowledge-center/acm-certificate-expiration
pentium75
👍 16
Nobody asked for cost optimization.
darekw
👍 4
AWS Certificate Manager (ACM) now publishes certificate metrics and events through Amazon CloudWatch and Amazon EventBridge. https://aws.amazon.com/about-aws/whats-new/2021/03/aws-certificate-manager-provides-certificate-expiry-monitoring-through-amazon-cloudwatch/
RupeC
👍 3
My understanding is that the ACM sends a Cert Expiration event to EventBridge. Thus EB. does not need to detect anything.
bigboi23
👍 1
Selected: B
Although option B of this says using a cron job that is triggered every Sunday. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/ Using an AWS config rule is ideal to trigger the CloudWatch event. Hence B
alfonso_ciampa
👍 2
Selected: D
I vote D, that's why: I have searched directly on AWS Dashboard in the EventBridge service and I discovered that as "target" of the event you CAN'T select "SNS" but "SNS topic" only (wich is a group of end users to who you send the notification). So I am sure about saying this, if you want to send a custom message with EventBridge, you should use a Lambda and create a custom SNS with it.
DAISY_93
👍 1
Yeah correct.
tamefi5512
👍 1
Selected: D
https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Yadav_Sanjay
👍 1
Selected: D
B is incorrect because aws config as inbuilt rule 'acm-certificate-expiration-check' and option is create a new rule. If inbuilt rule is there then why to create a new one. This is why D is correct
8mehmet11
👍 1
the ansver is a b.
elmogy
👍 2
Selected: B
EventBridge alone cannot detect the certificate expiry. It should receives the event of the certification expiration either from ACM or AWS Config. - for ACM it can be configured to send daily expiration events starting 45 days prior to expiration and the number of days can be configured. - and for AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days) https://repost.aws/knowledge-center/acm-certificate-expiration
beginnercloud
👍 1
Selected: D
https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Bmarodi
👍 1
Selected: D
I go for D. D meets reqirements.
ealpuche
👍 1
Selected: D
The answer is D
EA100
👍 3
ANSWER - D Here are the steps to set this up: Request or import the SSL/TLS certificate into ACM and attach it to the Elastic Load Balancers. Create a new CloudWatch Events rule with a schedule expression that matches the certificate expiration date. For example, if the certificate expires on May 31, 2023, the schedule expression should be: cron(0 0 31 4 ? 2023). Choose a target for the CloudWatch Events rule, such as an Amazon SNS topic or an AWS Lambda function. Configure the notification message to include information about the expiring certificate, such as its domain name, ACM certificate ID, and expiration date. Test the CloudWatch Events rule by simulating an expired certificate. By using ACM to manage the certificates and CloudWatch Events to trigger the notifications, the company can ensure that the security team is notified 30 days before the certificate expiration date, and can take appropriate actions to renew or replace the certificate in a timely manner.
eddie5049
👍 2
Selected: D
https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
rushi0611
👍 1
Selected: B
AWS Config has rule to check the certificate expiration, configure number of days to 30 we can attain the solution..
Yadav_Sanjay
👍 1
D- EventBridge alone can't check for certificate expiry. It should get info either from ACM (in case of ACM Issued certificate OR AWS Config (When imported on ACM from outside)) So B is correct
MiteshB
👍 3
Selected: D
Option D is the correct solution to meet the requirement. By creating an Amazon EventBridge rule, the solution can monitor the certificates hosted on the Elastic Load Balancer for any that are about to expire within 30 days. When a certificate meets this criteria, the rule triggers an AWS Lambda function that sends an email alert to the security team using Amazon SNS. This approach is the most efficient and targeted solution to meet the requirement as it only notifies the security team when a certificate is about to expire, reducing unnecessary notifications.
in4ern0
👍 1
The correct answer is option D: Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that will expire within 30 days. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS). Explanation: To meet the requirement of notifying the security team 30 days before the expiration of each certificate, a solutions architect can use Amazon EventBridge to schedule an event that will detect any certificates that will expire within 30 days. The event rule will then trigger an AWS Lambda function that sends a notification to the security team using Amazon SNS. This approach provides an automated and scalable solution to monitor and notify the team about certificate expiration.
studynoplay
👍 1
Please explain why B not D is the correct answer
jcramos
👍 2
D From Stephane Maarek training course: Option to generate the certificate outside of ACM and then import it • No automatic renewal, must import a new certificate before expiry • ACM sends daily expiration events starting 45 days prior to expiration • The # of days can be configured • Events are appearing in EventBridge • AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
jcramos
👍 1
B is the right ans
gx2222
👍 2
Selected: D
Option D is the best solution because it recommends using Amazon EventBridge to detect any certificates that will expire within 30 days. Amazon EventBridge provides a simple and scalable way to capture and route events from AWS services and third-party SaaS applications. In this case, an Amazon CloudWatch Events rule can be created to capture certificate expiration events, which will then trigger an AWS Lambda function. The Lambda function can be configured to send a custom alert through Amazon SNS to the security team. This solution is efficient, scalable, and addresses the requirement of notifying the security team 30 days before the certificate expiration.
alexiscloud
👍 1
Answer B: https://repost.aws/knowledge-center/acm-certificate-expiration
PaoloRoma
👍 1
Selected: B
Both B and D will do the job. I'll go for B as it support any threshold for expire days, while option D only support 45 days or less. If you go for D and you need a threshold greater than 45 you need to change your config with more effort connected to it
saransh_001
👍 2
Selected: D
Option B is a plausible solution, as it suggests creating an AWS Config rule to check for expiring certificates and using Amazon EventBridge to invoke a custom alert through Amazon SNS. However, AWS Config may incur additional charges, and the solution is complex, requiring multiple components to be set up. Option D is the recommended solution. It suggests creating an Amazon EventBridge rule that periodically checks for expiring certificates and invokes an AWS Lambda function to send custom alerts through Amazon SNS. This solution is simple, cost-effective, and efficient. Hence, the correct option is D.
PaddyAdallah
👍 1
A solutions architect should recommend creating a CloudWatch Events Rule to monitor the expiration of each certificate in AWS Certificate Manager (ACM). The rule should be configured to trigger an Amazon SNS notification 30 days prior to the expiration date of each certificate. This will ensure that the security team is notified in a timely manner.
osmk
👍 1
FOR COST SAVING B IS IDEAL OTHERWISE D
Bayebrymo
👍 8
But from the link shared. It doesnt state that you should invoke lambda function as stated in option D. Option B is explicitly stated in the article as also worded in option B. So i think B should be the answer. My thought though. i stand to be corrected.
TTaws
👍 9
Its B, simply because in option D - event bridge cannot "detect" anything.
gmehra
👍 1
Selected: D
Config is good to have but you can have Event bridge directly use and it can send the notification for straight 35 days (lets say certificate to be expire in 35 days)
fkie4
👍 5
All i wanna say is that I really hate this kind of question. The author of the question should have the question reviewed by some AWS experts. if there are 2 answers that are so close, he should consider changing the option, or abandon the question. I bet if all AWS expert on earth try to answer this question, the result will be 50-50
rushlav
👍 2
May be these belong to the 15 questions which are not scored..
sachin
👍 1
Both options are correct and viable. B and D . In D you just have to use Event Bridge and SNS whereas in B you have to user aws config additionaly to what we care using in D. So most efficient way is to go for D.
enc_0343
👍 1
I think D might be the correct answer here. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Stanislav4907
👍 2
hate question like this . How do we suppose to know if certificate was self-signed or 3d party.
cloudbusting
👍 1
correct answer is D https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html
sassy2023
👍 2
Selected: D
D seems like a better option https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
amgice
👍 1
Selected: B
AMC send event 45 days prior to expiration you can change de days in ACM so D is wrong. AWS has a managed rule named acm-certificate-expiration-check configurable with numbers of days
john626
👍 2
Selected: D
https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Joxtat
👍 2
Selected: D
Solution overview This solution provides a Lambda function that makes use of CloudWatch rules to report back those certificates that are due to expire within a pre-defined amount of time. The Lambda function is written to respond to CloudWatch events in two ways. When the event is time-based, the function looks for all certificates that have a DaysToExpiry metric. When the event is based on an event that is raised from a specific certificate, the function examines the single certificate. In both cases, the function logs the findings to Security Hub and sends out an SNS notification. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
techhb
👍 1
Selected: D
D & B BOTH Can do it, but B requires premium support,no such requirment withD.
techhb
👍 2
please ignore B is correct no premium support required.
lulzsec2019
👍 1
Selected: B
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/#:~:text=You%20can%20use%20AWS%20Config,are%20nearing%20the%20expiration%20date.
lulzsec2019
👍 1
Selected: B
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
goodmail
👍 1
Selected: B
B. I think D is incorrect, becuase the "more" correct operation shall be: ACM sends daily event to EventBridge, and EventBridge has rule to check expiry from these event. Not EventBridge actively scans for the cert expiry in ACM.
DavidNamy
👍 1
Selected: D
The correct answer is option D. A solution architect should recommend creating an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that expire within the next 30 days. Then, you should configure the rule to invoke an AWS Lambda function and configure the Lambda function to send a custom alert through Amazon Simple Notification Service (Amazon SNS). This option allows you to set up a solution that monitors certificates and sends an alert when the expiration date is approaching, which fulfills the requirement to notify the security team 30 days prior to the expiration of each certificate.
Buruguduystunstugudunstuy
👍 3
Selected: D
CORRECT Option D is the best answer because it involves using Amazon EventBridge (formerly known as Amazon CloudWatch Events), which is a fully managed event bus that makes it easy to set up and run event-driven applications. You can use EventBridge to create rules that trigger based on the occurrence of an event, such as the expiration of a certificate. By creating a rule that detects any certificates that will expire within 30 days, you can ensure that the security team is notified in a timely manner. In addition, Option D involves using an AWS Lambda function, which is a compute service that lets you run code without provisioning or managing servers. You can configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when it is triggered by the EventBridge rule. This allows you to automate the process of sending notifications to the security team.
Buruguduystunstugudunstuy
👍 3
WRONG Option A is not a viable solution because it would involve sending a daily message to the Amazon SNS topic, which would not be necessary or efficient. Option B is not the best choice because it involves using AWS Config, which is designed for monitoring and recording resource configurations. It is not well suited for monitoring the expiration of certificates. Option C is not a good fit because it involves using AWS Trusted Advisor, which is a tool that helps you optimize your AWS resources. It is not designed for monitoring the expiration of certificates.
FNJ1111
👍 2
Selected: D
This is from an AWS blog post in May 2021; AWS Config may have added the service, but assuming this question is from May 2021 time, the answer is D. "The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS." https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
career360guru
👍 1
Selected: B
Option B
career360guru
👍 1
Though B is right option among given choices there is new feature in AWS where ACM itself generates an event that can be used in Cloudwatch to trigger a check using Lambda. https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Uhrien
👍 1
It's gotta be C. AWS Config detect if everything is compliant. If not, Event bridge can be set to notify you via SNS
PDR
👍 1
it does seem like both B and D meet the requirements here, but with B being the better solution as has elements to configure and uses functionality that is more 'built in' so I would choose B
ashish_t
👍 3
Selected: B
I think, For SAA-C02: D But for SAA-C03: B
Wpcorgan
👍 1
B is correct
kvsomu
👍 1
With B option we won't get a notification, in the question we have option, must be notified. So the answer is B
htangga
👍 2
D is perfect : https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/
Onimole
👍 1
weird but i could also configure this using eventbridge without needing config.config just makes it easier
Vesperia
👍 1
Eventbridge is just an event bus, requires event sources. For expiring certificate, Config or now ACM can be the source.
jveluman
👍 1
Selected: B
B is Perfect
ManoAni
👍 20
Selected: B
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
LeGloupier
👍 100
B AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
824c449
👍 2
It does not have a built-in rule for checking the expiration of ACM certificates directly.
Mia2009687
👍 5
B costs more than D To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date. If you use AWS Config for this resolution, then be aware of the following: Before you set up the AWS Config rule, create the Amazon Simple Notification Service (Amazon SNS) topic and EventBridge rule. This makes sure that all non-compliant certificates invoke a notification before the expiration date. Activating AWS Config incurs an additional cost based on usage. For more information, see AWS Config pricing. https://repost.aws/knowledge-center/acm-certificate-expiration
ChrisG1454
👍 9
Answer B and answer D are possible according to this article. So, need to read B & D carefully to determine the most suitable answer. Reference: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
LeGloupier
👍 15
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
Moonus
👍 1
Selected: B
B is Perfect
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B matches AWS's documented pattern for ACM certificate expiration notifications: the AWS Config managed rule acm-certificate-expiration-check evaluates ACM certificates against a configurable expiration threshold such as 30 days. Imported certificates in ACM are not auto-renewed, so Config can flag them as noncompliant when they enter that window. EventBridge receives the AWS Config compliance-change event and targets an SNS topic for the security team. This gives a repeatable, per-account alerting mechanism without relying on support-plan-gated Trusted Advisor checks.Why the Other Options Are Wrong
Option A invents an ACM feature: ACM does not let you add a rule that publishes a custom SNS message every day starting 30 days before expiry. Option C uses Trusted Advisor, whose ACM certificate expiration check and CloudWatch metrics are tied to Business or Enterprise Support and are less precise than a Config managed rule. Option D is close but incorrectly says an EventBridge rule can "detect" certificates expiring within 30 days; EventBridge routes events, and the Lambda function would need additional expiry-evaluation logic that the option does not specify. The question asks for the recommended 30-day notification, and AWS Config's acm-certificate-expiration-check is the purpose-built control.Community Comment Notes
LeGloupier points directly to the managed rule "acm-certificate-expiration-check", which is the strongest technical confirmation for option B. TTaws makes a useful distinction that EventBridge is an event router, not an expiry detector, so option D is worded incorrectly. ChrisG1454 notes that both B and D appear in AWS guidance and says candidates must read them carefully, which is exactly why the Config-based wording wins here. Kaab_B cites the EventBridge-to-Lambda pattern, but that pattern starts from an ACM event rather than an EventBridge rule evaluating a 30-day window; Bayebrymo also observed that the linked article does not require Lambda for option D.Official Reference
Exam Strategy
For certificate-expiry questions, first identify whether the certificate is imported, because imported ACM certificates are your responsibility to renew. Then look for the AWS Config managed rule that checks expiration thresholds and an EventBridge-to-SNS notification path; avoid options that assume EventBridge can evaluate dates by itself or that Trusted Advisor is available without a support plan.
Frequently Asked Questions
Why is EventBridge plus Lambda (option D) not the best answer for ACM expiry?
An EventBridge rule routes events; it cannot itself detect certificates expiring within 30 days. AWS Config's acm-certificate-expiration-check performs that evaluation and reports noncompliance for SNS alerting.
Does acm-certificate-expiration-check cover imported ACM certificates?
Yes. The AWS Config managed rule evaluates ACM certificates, including imported ones, and reports noncompliance when they are within the configured expiry threshold; imported certificates are not auto-renewed.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →