title: AWS: Certificate agent status (ACM)
agents: aws_acm
catalog: cloud/aws
license: GPL-2.0-only
distribution: aws_acm
description:
 Shows the health of the special agent "Amazon Web Services (AWS)
 Certificates (ACM)" itself.

 The agent queries AWS only once per query interval (default 1 day) and
 answers from its cache in between. When an API call fails despite retries,
 it keeps serving the last known data and reports the error here instead of
 letting the certificate services disappear. Each error makes this service
 {WARN} (configurable).

 The service also reports the age of the oldest data among all regions and
 IAM, and goes {WARN} when it exceeds three times the query interval, or the
 levels from the rule "AWS ACM agent". Metrics are the number of API calls,
 retries and throttling responses of the current run - mostly zero, because
 most runs are served from cache - and the data age. A rising number of
 throttling responses reveals a shared rate limit bottleneck in the account
 long before data goes missing.

 It also points out when acm:DescribeCertificate is not permitted, in which
 case the certificate services lack the managed renewal status.

discovery:
 One service per host running the special agent.
