AWS transfer documentation change
Summary
Added certificate expiration monitoring documentation and CloudWatch integration details
Security assessment
Documents proactive certificate lifecycle management capabilities that help maintain secure communications, but doesn't fix a security issue.
Diff
diff --git a/transfer/latest/userguide/managing-as2-partners.md b/transfer/latest/userguide/managing-as2-partners.md index 836388eec..103fbdb39 100644 --- a//transfer/latest/userguide/managing-as2-partners.md +++ b//transfer/latest/userguide/managing-as2-partners.md @@ -95,0 +96,12 @@ X.509 certificates have `Not Before` and `Not After` dates. However, these param +### Certificate expiration monitoring + +Transfer Family publishes a Amazon CloudWatch metric `DaysUntilExpiry` after importing a certificate. The metric emits the number of days between the current date and the date specified as the `InactiveDate` on the Certificate. The metric is found under the `Transfer` AWS namespace in the CloudWatch metrics dashboard. + +This metric will always have a metric dimension for **CertificateId** and will optionally include a **Description** dimension if provided by the customer on the certificate. For more information about CloudWatch metric dimensions, see [Dimension](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_Dimension.html) in the _CloudWatch API Reference_. + +###### Note + +It can take up to a full day after importing a Certificate for Transfer Family to emit this metric to the customer account. + +You can use this metric to create CloudWatch alarms that notify you when certificates are approaching expiration. + @@ -97,0 +110,2 @@ Outbound certificate selection uses the maximum value that is prior to the date +### Certificate rotation example +