title: AWS: Certificates (ACM and IAM)
agents: aws_acm
catalog: cloud/aws
license: GPL-2.0-only
distribution: aws_acm
description:
 Monitors one TLS certificate of an AWS account: certificates in AWS
 Certificate Manager (ACM) of all types - Amazon-issued, imported and private
 (AWS Private CA) - and IAM server certificates as used by older ELB setups.
 The data comes from the special agent "Amazon Web Services (AWS)
 Certificates (ACM)".

 The remaining validity is computed on every check run from the expiry
 timestamp the agent reports, so it is exact even though the agent queries
 AWS only every few hours. It is {WARN} below 14 days and {CRIT} below 7 days,
 configurable separately for certificates that ACM renews itself (renewal
 eligibility ELIGIBLE) and for manually renewed ones (imported, ineligible,
 IAM). An expired certificate is always {CRIT}.

 The certificate status maps to a state: EXPIRED and REVOKED are {CRIT},
 FAILED, VALIDATION_TIMED_OUT and INACTIVE are {WARN}, ISSUED and
 PENDING_VALIDATION are {OK}. For certificates eligible for managed renewal
 that expire within 60 days, the agent fetches the managed renewal status; a
 renewal status of FAILED or PENDING_VALIDATION is {WARN}, because the
 automatic renewal is stuck, e.g. due to broken DNS validation.

 Certificates that ACM reports as not in use never get worse than {WARN}.

 All thresholds and states are configurable with the rule "AWS certificates".

item:
 For ACM: the domain name, the region and the first eight characters of the
 certificate ID, e.g. {shop.example.com eu-central-1/1a2b3c4d}. For IAM:
 {IAM} and the server certificate name.

discovery:
 One service per certificate. The rule "AWS certificate discovery" can
 restrict this to certificates in use, to certain types, and exclude domains
 by regular expression.
