Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 603 discussion

AWS Config rule + EventBridge. The answer is explained here - https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/

D is the answer

D seems correct “The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS.“ https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/

I will go with B D is out bcz of the extra lambda invocation to send out the notification which can be avoided

B sounds good but it goes too distant as it mentions "invoke SNS when AWS config reports noncomplience resources" addtionally. The question only asks about expiration notification. So D should be correct. This question is indeed quesiton-question... tricky but competitive one. https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html

Confused between A and D... but will go for D