Exam AWS Certified Security - Specialty topic 1 question 389 discussion

I go with D https://docs.aws.amazon.com/acm/latest/userguide/supported-events.html

D .. i remember i did it once and it actually works ✅

D. { "version": "0", "id": "abc", "detail-type": "ACM Certificate Approaching Expiration", "source": "aws.acm", "account": "", "time": "2020-09-30T06:51:08Z", "region": "us-east-1", "resources": ["arn:aws:acm:us-east-1:*:certificate/abc"], "detail": { "DaysToExpiry": 31, "CommonName": "example.com" } }

Answer is D: Use EventBridge Rules - https://docs.aws.amazon.com/acm/latest/userguide/example-actions.html

EventBridge using predefined patterns for ACM is operationally efficient compared to adding all the certificates ARN to CloudWatch.

https://docs.aws.amazon.com/acm/latest/userguide/cloudwatch-metrics.html PDF RSS Amazon CloudWatch is a monitoring service for AWS resources. You can use CloudWatch to collect and track metrics, set alarms, and automatically react to changes in your AWS resources. ACM publishes metrics once per day for every certificate in an account until expiration. The AWS/CertificateManager namespace includes the following metric. Metric Description Unit Dimensions DaysToExpiry Number of days until a certificate expires. ACM stops publishing this metric after a certificate expires.

D is the correct answer since DaysToExpire is good-to-go as an alert in AWS CloudWatch and, also, any future certificate is automatically monitored.

Correct Answer is B Read the below text from the AWS documentation "The second option uses the recently launched DaysToExpiry metric to schedule a batch search of expiring certificates and to log all the findings. The metric also provides a single SNS notification for all expiring certificates...." https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/

https://aws.amazon.com/about-aws/whats-new/2021/03/aws-certificate-manager-provides-certificate-expiry-monitoring-through-amazon-cloudwatch/

The answer is B, There is no predefined event rule under eventBridge. It has to be setup with Config --> CWEvent Bridge which is not mentioned here. But, ACM daily sending the metrics called DaystoEpiry to CW on all the ACM certificates. You have to set the alarm base on this metrics under the ACM namespace. https://docs.aws.amazon.com/acm/latest/userguide/cloudwatch-metrics.html

https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/

D is correct D: provide alerts by email when a certificate is approaching its expiration date. B: using run report for all certificates on a timer with DaysToExpiry metric in CloudWatch (option 2 of reference link) https://aws.amazon.com/blogs/security/how-to-monitor-expirations-of-imported-certificates-in-aws-certificate-manager-acm/

B - ACM works with cloud watch and SNS https://docs.aws.amazon.com/acm/latest/userguide/cloudwatch-events.html