ACM certificate has Certificate Transparency logging on

Check ID: acm_certificates_transparency_logs_enabled
Provider: AWS
Service: acm
Severity: MEDIUM
Categories: logging
Resource type: AwsCertificateManagerCertificate

What this check verifies

ACM-issued certificates are checked for Certificate Transparency (CT) logging being enabled. Certificates with type IMPORTED are excluded from evaluation.

Risk

Disabling CT logging reduces visibility into misissued or rogue certificates, weakening confidentiality and integrity. Attackers can impersonate sites or run TLS man-in-the-middle without timely detection. Unlogged public certs may be distrusted by browsers, impacting availability and user trust.

Recommendation

Enable CT logging on all ACM-issued public certificates to maintain transparency and rapid revocation. Monitor CT logs for your domains and alert on unexpected issuances. For sensitive internal names, favor private PKI or non-public hostnames instead of disabling CT, and apply defense in depth with short certificate lifetimes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws acm update-certificate-options --certificate-arn <CERTIFICATE_ARN> --options CertificateTransparencyLoggingPreference=ENABLED

# Enable Certificate Transparency logging on an ACM certificate
resource "aws_acm_certificate" "<example_resource_name>" {
  domain_name = "<example_domain_name>"
  options {
    certificate_transparency_logging_preference = "ENABLED"  # Critical: turns on CT logging to pass the check
  }
}

# CloudFormation: Enable Certificate Transparency logging on an ACM certificate
Resources:
  <example_resource_name>:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: <example_domain_name>
      CertificateTransparencyLoggingPreference: ENABLED  # Critical: turns on CT logging to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = acm_certificates_transparency_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ACM certificate expires beyond the configured threshold ACM certificate uses a secure key algorithm

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires