AWS Certificate Manager (ACM) – Best Practices

AWS Certificate Manager (ACM) is Amazon’s managed service for issuing, deploying, and renewing SSL/TLS certificates across AWS resources. It matters because a misconfigured certificate lifecycle causes outages, failed audits, and exposed private keys. The recommended action: enable DNS validation, enforce least-privilege IAM policies, rotate and log every certificate event, and decide deliberately between AWS-managed keys and external key custody.

Published: August 2020. Updated: August 2026. Written by Aditi Goel; reviewed by Encryption Consulting’s PKI & Cloud Key Management Advisory Team.

What Is AWS Certificate Manager (ACM)?

AWS Certificate Manager (ACM) is a managed service that provisions, deploys, and renews public and private SSL/TLS certificates for workloads running on Amazon Web Services. ACM issues certificates from Amazon’s public certificate authority (CA) or from AWS Private Certificate Authority (formerly ACM Private CA), letting small and mid-size teams stand up their own Public Key Infrastructure (PKI) without operating CA software themselves. Elastic Load Balancing, Amazon CloudFront, Elastic Beanstalk, and API Gateway all consume ACM certificates natively.

For the broader architecture behind ACM’s private CA option, read PKI on Amazon Web Services.

Why Do ACM Best Practices Matter for Compliance?

Following ACM best practices keeps certificate issuance, storage, and revocation aligned with the controls that Payment Card Industry Data Security Standard (PCI DSS), NIST SP 800-57, and regional frameworks such as APRA CPS 234 actually test for during an audit. Auditors look for evidence of key protection, access control, and logging, not just a valid certificate chain, so the practices in this article are written to produce that evidence rather than just pass a browser padlock check.

Should You Use ACM’s Native Keys or External Key Control?

Use ACM’s native, AWS-managed keys for any certificate consumed directly by an AWS-integrated service, and reserve BYOK or HYOK for workloads where a regulator, contract, or internal policy requires you to prove custody of the private key material yourself. The right choice is a spectrum, not a binary switch, and most enterprises run more than one model at once.

AWS KMS External Key Store uses double encryption: data is first encrypted by a key inside your AWS account’s KMS, then re-encrypted under the key held in your external key manager, so no ciphertext is ever recoverable without that external key. Whether BYOK or HYOK is the right call depends mainly on where the originating key material must legally or contractually live; see our Hybrid KMS explainer for the full BYOK-vs-HYOK comparison, and HSM-as-a-Service if you need FIPS-validated key custody without operating the hardware yourself.

What Does the IAM Model for ACM Look Like?

ACM has no resource-based policies of its own. Access is controlled entirely through IAM identity-based policies attached to users and roles, plus KMS grants for any private key genuinely usable outside ACM’s automatic renewal path. A least-privilege ACM setup follows five steps:

1. Separate AWS accounts or organizational units for production versus test/development certificates, so a compromised test role can never touch a production certificate.
2. Grant acm:RequestCertificate, acm:DescribeCertificate, and acm:ListCertificates to roles, not individual users, and scope them with resource ARNs where possible.
3. Deny kms:CreateGrant by default, and allow it only when the kms:EncryptionContext:aws:acm:arn condition key matches an approved certificate ARN.
4. Require MFA for AWS Private CA administrative actions, including CreateCertificateAuthority and ScheduleCertificateAuthorityDeletion.
5. Review IAM Access Analyzer findings for every ACM- and Private-CA-linked role on a quarterly cadence.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyGrantExceptApprovedCert",
      "Effect": "Deny",
      "Action": "kms:CreateGrant",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "kms:EncryptionContext:aws:acm:arn": "arn:aws:acm:us-east-1:111122223333:certificate/EXAMPLE-CERT-ID"
        }
      }
    }
  ]
}

This policy denies kms:CreateGrant for every certificate except the one ARN you name, so a role can only request grants for certificates it is explicitly scoped to — adapted from AWS’s own ACM best-practices documentation.

How Should You Handle Certificate Rotation in ACM?

DNS-validated public certificates issued directly by ACM renew and rotate themselves automatically — starting 60 days before expiry for legacy 395-day certificates, and 45 days before expiry for the new 198-day default. Certificates you import, or keys you manage outside ACM, do not, and need an explicit rotation policy.

• Use DNS validation, not email validation, so renewal never depends on someone acting on an email within a validation window.
• Never pin an ACM-managed certificate in an application. ACM’s automatic renewal issues a new key pair each time, which breaks certificate or public-key pinning. Pin to the Amazon root CA, or to your own Private CA root, instead.
• For AWS KMS symmetric keys, enable automatic rotation on a configurable schedule of 90 days to 2,560 days (about seven years). Asymmetric and HMAC KMS keys are not eligible for automatic rotation and must be rotated by creating a new key.
• Imported KMS key material supports on-demand rotation — up to ten rotations over the key’s lifetime — for organizations that need to rotate outside the automatic schedule without changing the key ID applications reference.
• Track the CA/B Forum glide path: 200-day maximum validity from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029 (Ballot SC-081v3). Our 47-day certificate automation guide covers the renewal-window math in detail.

What Should You Log and Monitor for ACM and KMS?

Turn on AWS CloudTrail before you issue your first ACM certificate, not after. CloudTrail captures every ACM API call — issuance, renewal, deletion, export — along with the calling identity, source IP, and timestamp, and it separately captures both KMS management calls (create, rotate, disable, policy edits) and KMS cryptographic calls (encrypt, decrypt, generate-data-key).

• Alert on ScheduleCertificateAuthorityDeletion and any root-CA policy change — these are catastrophic if unauthorized.
• Alert on certificate export events, since an exported private key leaves ACM’s automatic-rotation protection entirely.
• Alert on repeated validation failures or stalled DNS records, which often signal a certificate that will miss its renewal window.
• Feed CloudTrail into CloudWatch alarms or your SIEM, and retain logs long enough to satisfy your compliance framework’s audit-lookback requirement (PCI DSS requires at least twelve months, with the most recent three immediately available).

How Much Does ACM Actually Cost?

ACM certificates used directly by AWS-integrated services are free; you pay only when you need an exportable certificate or your own private CA. AWS cut exportable-certificate pricing when it shortened default public-certificate validity to 198 days on February 18, 2026.

Short-lived mode is priced for exactly the high-issuance-volume pattern that 47-day certificates create — worth modeling before the 2029 validity cliff, not after it.

What Does a Multi-Cloud Certificate and Key Architecture Look Like With ACM?

In a multi-cloud estate, ACM should sit as one regional issuance endpoint underneath a centralized certificate lifecycle management (CLM) layer that also talks to Azure Key Vault, Google Cloud CAS, and any on-premises CA — not as an isolated, AWS-only source of truth. A common pattern is hub-and-spoke: a central policy and monitoring layer federates with each cloud’s native CA, including AWS Private CA, while ACME clients such as cert-manager handle in-cluster and in-VPC issuance against whichever spoke sits closest to the workload.

For the full reference architecture, including cert-manager and Kubernetes integration patterns AWS’s own documentation does not cover, see our Multi-Cloud PKIaaS Architecture Guide for AWS, Azure, and GCP. If you are deciding whether to build this yourself or run it as a service, Self-Managed PKI vs. PKIaaS walks through that decision with a scored matrix.

What Are the Limitations of AWS Certificate Manager?

ACM is not a full certificate lifecycle management platform, and it has hard edges worth knowing before you standardize on it.

• You cannot add or remove a domain on an existing certificate. You must request an entirely new certificate and re-validate every domain, including ones already validated.
• AWS Private CA’s root CA private key is never exportable, so migrating away from it later means re-issuing your entire certificate chain.
• ACM is regional; a global or multi-region footprint needs an explicit replication or federation strategy, not a default.
• Public certificates are logged to public Certificate Transparency logs — never put confidential information in a certificate’s domain name.
• ACM’s native key-control model has no HYOK option. HYOK requires configuring AWS KMS External Key Store separately, and that only covers KMS-protected data, not ACM certificates themselves.

AWS ACM Best Practices Checklist

These twelve practices are what we check first during an AWS PKI assessment, roughly in the order they tend to matter:

1. Monitor certificate expiry. Even with auto-renewal on DNS-validated certificates, track expiry dates directly; imported certificates and edge cases will not renew themselves.
2. Validate certificate requests promptly. Prefer DNS validation; email validation requests expire if unactioned and can interrupt issuance for a new service.
3. Minimize root CA use. Issue day-to-day certificates from an intermediate CA and keep the root CA in a separate, tightly restricted account.
4. Enforce TLS 1.2 or higher, and prefer TLS 1.3. Disable SSL and TLS 1.0/1.1 entirely; both fail current PCI DSS and browser requirements.
5. Protect private keys. Prefer ACM-generated keys; if you import certificates, require strong key parameters (RSA 2048-bit minimum, or ECDSA P-256/P-384).
6. Avoid wildcard certificates where practical. A single-domain certificate per host limits the blast radius if any one key is compromised.
7. Restrict certificate imports to certificates and keys from trusted, verifiable sources only.
8. Always use a fully qualified domain name (FQDN) in the certificate, never an alias.
9. Audit your certificate inventory regularly, and automate the audit with AWS Config rules rather than a manual quarterly spreadsheet.
10. Enable CloudTrail and CloudWatch alarms before your first certificate request, not after an incident.
11. Never pin an ACM-managed certificate. Automatic renewal rotates the key pair and will break the pin.
12. Decide your key-control model up front. Document whether a workload uses native ACM/KMS keys, BYOK, or HYOK in your CP/CPS before you scale past a handful of certificates.

What Would Encryption Consulting Recommend?

ACM is a strong default for certificates consumed entirely inside AWS-native services, and there is no reason to pay for anything else in that case. It stops being enough the moment certificate and key operations need to span AWS, Azure, and GCP, or the moment a regulator asks you to prove key custody outside AWS. In our engagements, the recurring failure mode is not one weak certificate; it is treating ACM as the system of record for an estate it was never designed to see across. We recommend running ACM as one enrollment endpoint under a unified certificate lifecycle manager like CertSecure Manager, with key custody handled through PKI-as-a-Service or HSM-as-a-Service when HYOK is the requirement, rather than letting ACM’s console become the only place anyone can see the full certificate picture.

Frequently Asked Questions

Does ACM support Hold Your Own Key (HYOK)?

Not directly for ACM certificates. AWS’s HYOK equivalent, KMS External Key Store (XKS), keeps a key outside AWS and requires AWS to call out to your external key manager for every cryptographic operation, but XKS protects KMS-encrypted data, not ACM certificate private keys, which ACM always generates and stores itself unless you import a certificate.

Is AWS Certificate Manager free?

Public certificates used directly with AWS-integrated services such as Elastic Load Balancing, CloudFront, and API Gateway are free. You pay only for exportable public certificates ($7/FQDN, $79/wildcard), ACME-issued certificates outside that free tier, and AWS Private CA, which carries a monthly per-CA fee plus per-certificate issuance costs.

Can I export the private key from an ACM-issued certificate?

Only if you specifically requested an exportable public certificate, which carries its own per-FQDN fee. Standard ACM certificates used with AWS-integrated services generate a private key that is never accessible outside ACM, by design.

What happens to my certificates under the CA/B Forum’s shorter validity schedule?

Nothing breaks automatically if your certificates are DNS-validated and auto-renewing; ACM already issues new public certificates at the 198-day default. The real risk is certificates issued, imported, or pinned outside ACM’s automatic renewal path. Those need an explicit plan before the schedule tightens to 100 days in March 2027 and 47 days in March 2029.

Should I use AWS Private CA or a managed PKI service instead?

AWS Private CA is a solid fit if every consumer of your certificates lives inside AWS. If you also issue to Azure, GCP, on-premises servers, or non-AWS Kubernetes clusters, a managed PKI-as-a-Service layer that federates with AWS Private CA typically costs less in engineering time than maintaining parallel, disconnected CA hierarchies per cloud.

If your organization is looking for help implementing or federating AWS Certificate Manager and AWS Private CA into a broader PKI program, contact [email protected].