AWS ACM
AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with AWS services. Certificates renew automatically.
What is ACM? (Simple Explanation)
Think of ACM like an auto-renewing passport for your website. It provides the SSL certificate that makes your site show the padlock icon, and renews it before it expires.
When Would You Use ACM?
- TLS/SSL for web applications
- API endpoint encryption
- Enterprise PKI with private certificates
- Compliance-mandated encryption in transit
Who Uses ACM?
From startups to enterprises, ACM powers:
What Makes ACM Powerful
ACM Pricing & Free Tier
Core security services (IAM, KMS, CloudTrail, Shield Standard) are always free. Advanced features (GuardDuty, WAF, Shield Advanced) have per-usage pricing.
ACM Best Practices
- 1Enable MFA on all IAM users and root account
- 2Never use root account for daily tasks — create IAM users with least privilege
- 3Enable CloudTrail across all regions with log file validation
- 4Rotate access keys every 90 days and never commit them to source control
- 5Use IAM roles for EC2/Lambda/ECS instead of long-term access keys
Getting Started with ACM in 5 Minutes
- 1Open the AWS Console and navigate to ACM
- 2Review the default settings — most security services are pre-configured with best-practice defaults
- 3Define your policies, rules, or detection scope based on your environment
- 4Enable logging to CloudTrail and set up alerts to SNS for critical findings
ACM CLI Quick Reference
2 production-ready commands. Full CLI Library (225+ services) →
aws acm list-certificates --query 'CertificateSummaryList[*].{Domain:DomainName,ARN:CertificateArn,Status:Status,Type:Type}' --output tableList all ACM certificatesaws acm describe-certificate --certificate-arn arn:aws:acm:us-east-1:xxx:certificate/xxxView certificate details and expiryPros & Cons of ACM
Pros
- Free public certificates for ALB, CloudFront, API Gateway
- Automatic renewal and deployment
- Private CA for enterprise internal PKI
- Wildcard and multi-domain certificates
- Imported certificates for existing PKI investments
Cons
- ✕Proper IAM policy design has a steep learning curve — overly permissive policies are common
- ✕Root account is a single point of failure if MFA is lost
- ✕CloudTrail logs can become expensive at scale without lifecycle management
ACM vs Alternatives
ACM vs CloudFront
Choose ACM for TLS/SSL for web applications and API endpoint encryption. It excels at free public certificates for alb, cloudfront, api gateway.
Choose CloudFront as an alternative when your requirements differ. Each service in the Security category serves different architectural patterns.
Services That Work with ACM
ACM is rarely used alone. It is typically combined with:
Compliance & Security
How AWS ACM fits into major compliance standards. Browse all 41 frameworks →
ACM configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults.
NIST 800-53ACM access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families.
PCI DSS 4.0ACM encryption, access control, and logging support PCI DSS for cardholder data environments.
SOC 2ACM security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria.
ISO 27001ACM configuration and monitoring controls map to ISO 27001 Annex A information security management.
Frequently Asked Questions About ACM
What is AWS ACM?
AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with AWS services. Certificates renew automatically.
What is ACM used for?
ACM is commonly used for: TLS/SSL for web applications; API endpoint encryption; Enterprise PKI with private certificates; Compliance-mandated encryption in transit. It's a core service in the security category of AWS.
Is ACM free?
Core security services (IAM, KMS, CloudTrail, Shield Standard) are always free. Advanced features (GuardDuty, WAF, Shield Advanced) have per-usage pricing.
What are the key features of ACM?
ACM's most important capabilities include: Free public certificates for ALB, CloudFront, API Gateway. Automatic renewal and deployment. Private CA for enterprise internal PKI. Wildcard and multi-domain certificates. Imported certificates for existing PKI investments. Each of these is designed to help teams tls/ssl for web applications.
How does ACM compare to alternatives?
ACM competes with both AWS-native alternatives (CloudFront, ELB, API Gateway) and third-party equivalents. The right choice depends on your specific requirements for scalability, cost, and operational overhead. See the comparisons section below for detailed guidance.
Which compliance frameworks apply to ACM?
CIS AWS v3.0: ACM configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults. NIST 800-53: ACM access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families. PCI DSS 4.0: ACM encryption, access control, and logging support PCI DSS for cardholder data environments. SOC 2: ACM security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria. ISO 27001: ACM configuration and monitoring controls map to ISO 27001 Annex A information security management.
People also search for
Was this page helpful?
Ready to secure your ACM configuration?
Pavora continuously monitors your AWS ACM for misconfigurations, compliance violations, and security risks.