AWS AWSCloudFormation documentation change
Summary
Added documentation for CloudWatch metric tracking certificate expiration
Security assessment
The new metric helps monitor certificate lifecycle management, which is a security best practice. However, this is a proactive monitoring feature addition rather than a response to a security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-transfer-certificate.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-transfer-certificate.md index a9427479b..bdd6c9c27 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-transfer-certificate.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-transfer-certificate.md @@ -12,0 +13,6 @@ You can import both the certificate and its chain in the `Certificate` parameter +After importing a certificate, AWS Transfer Family automatically creates a Amazon CloudWatch metric called `DaysUntilExpiry` that tracks the number of days until the certificate expires. The metric is based on the `InactiveDate` parameter and is published daily in the `AWS/Transfer` namespace. + +###### Important + +It can take up to a full day after importing a certificate for Transfer Family to emit the `DaysUntilExpiry` metric to your account. + @@ -16,0 +23,15 @@ If you use the `Certificate` parameter to upload both the certificate and its ch +**CloudWatch monitoring** + +The `DaysUntilExpiry` metric includes the following specifications: + + * **Units:** Count (days) + + * **Dimensions:**`CertificateId` (always present), `Description` (if provided during certificate import) + + * **Statistics:** Minimum, Maximum, Average + + * **Frequency:** Published daily + + + +