A team requests three ACM public certificates: one attached to a CloudFront distribution and validated using DNS validation, one requested through ACM using email validation but never attached to any AWS resource, and one imported into ACM from a third-party certificate authority. Which of these will renew before expiry without any manual action from the team?
- All three, because ACM automatically manages renewal for every certificate in its inventory regardless of validation method or usage
- Only the imported third-party certificate, because ACM tracks externally issued certificates most closely for expiry
- Only the certificate attached to the CloudFront distribution: it renews automatically because it is DNS-validated and currently in use by an AWS service, while the email-validated certificate needs the domain owner to click a renewal link and the imported certificate is never eligible for managed renewal at all
- None of the three, because ACM never renews any certificate automatically and always requires submitting a brand-new certificate request
Why C? And why not the others?
Correct answer: C. Only the certificate attached to the CloudFront distribution: it renews automatically because it is DNS-validated and currently in use by an AWS service, while the email-validated certificate needs the domain owner to click a renewal link and the imported certificate is never eligible for managed renewal at all
ACM's managed renewal is fully automated only for certificates that were originally DNS-validated and that remain currently in use by an integrated AWS service, since ACM can silently reverify domain ownership through the existing DNS records; the CloudFront-attached, DNS-validated certificate satisfies both conditions. A certificate validated by email instead requires the domain owner to click a link in a renewal notice, so it is not renewed without manual action, and an imported certificate is never eligible for ACM managed renewal under any circumstance. The option claiming every certificate renews automatically regardless of validation method or usage is wrong because it ignores both the validation-method requirement and the in-use requirement. The option favoring the imported certificate is wrong because imported certificates are explicitly excluded from managed renewal. The option claiming none of the three renew automatically is wrong because the DNS-validated, in-use certificate does renew without any manual step.
Source: AWS Certificate Manager documentation: Renewal for domains validated by DNS (https://docs.aws.amazon.com/acm/latest/userguide/dns-renewal-validation.html)