Expired SSL/TLS certificate stored in IAM

What this check finds

An SSL/TLS server certificate held in the IAM certificate store has passed its expiry date. IAM's store is the legacy home for certificates, used only in regions ACM does not serve, and nothing prunes it — an expired certificate sits there indefinitely. Attaching one causes an outage that looks like a misconfiguration rather than an expiry, and its private key remains uploaded and retrievable by anyone who can call IAM.

Passing looks like: No expired certificates in the IAM store.

How to fix it

Delete the certificate once nothing references it: aws iam delete-server-certificate --server-certificate-name NAME. Check first that no ELB or CloudFront distribution still points at it. For anything still needed, migrate to AWS Certificate Manager, which renews automatically.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

• HighDeprecated or flawed AWS managed policy in use
• HighIAM role allows assumption from anywhere
• HighIAM role with admin privileges can be assumed by unexpected principals
• HighIAM role with s3 listing and get privileges can be assumed by unexpected principals
• HighIAM user access key has not been rotated in over 180 days
• HighIncorrect policy used to attempt to enforce MFA
• HighInline policy allows privilege escalation to admin
• HighPrincipal has an attached policy granting administrative access

All IAM checks