AWS-IAM-expired-SSL-TLS-certificates-removed

Owned by naveen
Nov 29, 2021
1 min read

Severity: High

Description: This control ensures that there are no expired server certificates stored in AWS IAM. SSL/TLS server certificate are used to enable HTTPS connections to website or application in AWS. IAM can store and deploy server certificates. Use IAM as a certificate manager only when it must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, it must be obtain from an external provider for use with AWS.

Remediation Steps:

Perform following to delete expired server certificate using AWS CLI:

  1.  aws iam delete-server-certificate --server-certificate-name [CERTIFICATE_NAME].

Important:

  • To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI)..

Reference:

Blue Hexagon Proprietary