AWS acm medium security documentation change

Service: acm · 2025-06-19 · Security-related medium

File: acm/latest/userguide/supported-events.md

Summary

Added documentation for two new ACM events: Certificate Revoked and Certificate Updated, including event structures and use cases

Security assessment

The addition of 'Certificate Revoked' event documentation directly relates to security monitoring. Certificate revocation is a critical security control used when certificates are compromised or invalidated. This change enables customers to detect security-relevant certificate status changes through EventBridge alerts.

Diff

diff --git a/acm/latest/userguide/supported-events.md b/acm/latest/userguide/supported-events.md
index bafd07f65..faba6b958 100644
--- a//acm/latest/userguide/supported-events.md
+++ b//acm/latest/userguide/supported-events.md
@@ -5 +5 @@
-ACM Certificate Approaching Expiration eventACM Certificate Expired eventACM Certificate Available eventACM Certificate Renewal Action Required eventAWS health events
+ACM Certificate Approaching Expiration eventACM Certificate Expired eventACM Certificate Available eventACM Certificate Renewal Action Required eventACM Certificate Revoked eventACM Certificate Updated eventAWS health events
@@ -15 +15 @@ ACM sends daily expiration events for all active certificates (public, private a
-ACM automatically initiates renewal of eligible certificates that it issued, but imported certificates need to be reissued and reimported prior to expiration to avoid outages. For more information, see [Reimporting a certificate](https://docs.aws.amazon.com/acm/latest/userguide/import-reimport.html#reimport-certificate-api). You can use expiration events to set up automation to reimport certificates into ACM. For an example of automation using AWS Lambda, see [Triggering actions with Amazon EventBridge in ACM](./example-actions.html).
+ACM automatically initiates renewal of eligible certificates that it issued, but imported certificates need to be reissued and reimported prior to expiration to avoid outages. For more information, see [Reimporting a certificate](https://docs.aws.amazon.com/acm/latest/userguide/import-reimport.html#reimport-certificate-api). You can use expiration events to set up automation to reimport certificates into ACM. For an example of automation using AWS Lambda, see [Initiating actions with Amazon EventBridge in ACM](./example-actions.html).
@@ -135,0 +136,62 @@ _ACM Certificate Renewal Action Required_ events have the following structure.
+## ACM Certificate Revoked event
+
+Customers can listen on this event to alert them if an ACM issued public or private certificate in their account is revoked.
+
+###### Note
+
+Imported certificates cannot be revoked via revoke-certificate.
+
+_ACM Certificate Revoked_ events have the following structure.
+    
+    
+    {
+      "version": "0",
+      "id": "id",
+      "detail-type": "ACM Certificate Revoked",
+      "source": "aws.acm",
+      "account": "account",
+      "time": "2019-12-22T18:43:48Z",
+      "region": "region",
+     "resources": [
+            "arn:aws:acm:region:account:certificate/certificate_ID"
+         ],
+      "detail": {
+        "CertificateType" : "AMAZON_ISSUED" | "PRIVATE", 
+        "CommonName": "example.com",
+        "CertificateExpirationDate" : "2019-12-22T18:43:48Z",
+        "Exportable": TRUE | FALSE
+      }
+    }
+
+## ACM Certificate Updated event
+
+Customers can listen on this event to alert them if an ACM issued public or private certificate in their account is updated.
+
+_ACM Certificate Updated_ events have the following structure.
+    
+    
+    {
+      "version": "0",
+      "id": "id",
+      "detail-type": "ACM Certificate Revoked",
+      "source": "aws.acm",
+      "account": "account",
+      "time": "2019-12-22T18:43:48Z",
+      "region": "region",
+     "resources": [
+            "arn:aws:acm:region:account:certificate/certificate_ID"
+         ],
+      "detail": {
+        "Action" : "ISSUANCE" | "RENEWAL" | "IMPORT" | "REIMPORT",
+        "CertificateType" : "AMAZON_ISSUED" | "PRIVATE" | "IMPORTED", 
+        "CommonName": "example.com",
+        "DomainValidationMethod" : "EMAIL" | "DNS",    
+        "CertificateCreatedDate" : "2018-12-22T18:43:48Z",
+        "CertificateExpirationDate" : "2019-12-22T18:43:48Z",
+        "DaysToExpiry" : 395,
+        "InUse" : TRUE | FALSE,    
+        "Exported" : TRUE | FALSE
+        "Exportable" : TRUE | FALSE 
+      }
+    }
+