Check ID: iam_no_expired_server_certificates_stored
Provider: AWS
Service: iam
Severity: HIGH
Categories: encryption
Resource type: AwsCertificateManagerCertificate

​
What this check verifies

IAM server certificates stored in AWS IAM are evaluated for expiration by comparing their validity period to the current time. Certificates with a NotAfter date in the past are identified as expired.

​
Risk

Retaining expired TLS certificates risks availability loss from failed handshakes and browser warnings, eroding trust. If attached to endpoints, users may bypass warnings, weakening confidentiality and integrity. Stale certs also hinder secure rotation and may be picked by automation, causing outages.

​
Recommendation

Remove expired certificates from IAM and ensure endpoints use current, trusted TLS. Prefer AWS Certificate Manager for issuance and auto-renewal, enforce lifecycle management with inventory, tagging, and alerts, and apply least privilege to certificate access with standardized rotation policies.

​
Remediation

aws iam delete-server-certificate —server-certificate-name <CERTIFICATE_NAME>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_no_expired_server_certificates_stored. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks