AWS Certificate Manager

Permanently removes an ACM certificate from your account — useful when decommissioning a domain or replacing an expiring cert with a freshly issued one.

Fetches the full details of a single ACM certificate — status, domain names, validation records, and expiry date — by its ARN.

Lists all ACM certificates in an AWS region, optionally filtered by status, so the agent can scan the entire fleet in one call.

Retrieves the lightweight metadata record for a certificate — ARN, domain, status, type, and creation date — without fetching the full chain.

Triggers a managed renewal for an eligible ACM certificate, restarting the validation process so the cert is reissued before the current one expires.

Submits a new certificate request to ACM for one or more domain names, choosing DNS or email validation and optional private CA issuance.

Imports an externally issued SSL/TLS certificate — including its private key and certificate chain — into ACM so it can be attached to AWS resources.

Exports a private ACM certificate along with its private key and certificate chain, enabling use on non-AWS infrastructure.

Attaches one or more key-value tags to an ACM certificate for cost allocation, environment labelling, and policy enforcement.

Removes specific tags from an ACM certificate, useful for decommissioning labels or correcting tagging mistakes.

Returns all tags attached to a specific ACM certificate, enabling the agent to verify compliance or route decisions based on label values.

Resends the domain-ownership validation email for an email-validated certificate when the original message was missed or expired.

Modifies the certificate transparency logging option for an existing ACM certificate, enabling or disabling logging to public CT logs.

Returns comprehensive details about a certificate including validation options, renewal eligibility, associated resources, and the full SAN list.

Lists all ACM Private Certificate Authorities in the account, including their ARNs, statuses, and type (root or subordinate).

Fires when ACM successfully issues a new certificate — whether Amazon-managed or private CA — and it transitions to ISSUED status.

Fires when domain ownership validation finishes — either successfully granting ISSUED status or failing — so the agent can act immediately either way.

Fires when ACM detects a certificate is within 45 days of expiry — giving the agent an early warning window to intervene before any service interruption.

Fires when a certificate passes its expiry date without being renewed, signalling a potential live TLS failure that the agent should escalate immediately.

Fires when ACM successfully completes a managed renewal and the certificate transitions to a new ISSUED state with an extended expiry.

Fires when ACM cannot verify domain ownership after a request, surfacing the failure reason so the agent can route a targeted fix before the validation window closes.

Fires when an imported certificate is revoked by its issuing CA, requiring the agent to immediately replace or detach it to avoid broken TLS connections.