# Certificate Manager

Retrieves and monitors certificate information from AWS Certificate Manager.

## Details

The AWS Certificate Manager input collects certificate information from AWS Certificate Manager. It retrieves certificate ARNs, domain names, and related certificate information based on the configured filters.

## Requirements
- [IAM Role Assumption / Static Credentials](./index.mdx#authentication-methods)
- Example permission to attach to the role/user:
```json 
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "ACMPermissions",
         "Effect": "Allow",
         "Action": [
            "acm:ListCertificates",
            "acm:DescribeCertificate"
         ],
         "Resource": "*"
      }
   ]
}
```

## Configuration

### Settings

| Setting              | Type   | Required | Default | Description                                                                                                                                                                                                                                                                                                                                                                 |
|----------------------|--------|----------|---------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| role_arn             | string | Yes | - | The ARN of the role to assume to access the certificate manager                                                                                                                                                                                                                                                                                                             |
| cron                 | string | Yes | - | Cron expression for scheduling the input                                                                                                                                                                                                                                                                                                                                    |
| region               | array  | Yes | - | Filter the certificate list by region (us-east-1, us-east-2, us-west-1, us-west-2, af-south-1, ap-east-1, ap-south-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-southeast-1, ap-southeast-2, ca-central-1, cn-north-1, cn-northwest-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, eu-south-1, me-south-1, sa-east-1, us-gov-east-1, us-gov-west-1) |
| certificate_statuses | array  | No | - | Filter the certificate list by status value (PENDING_VALIDATION, ISSUED, INACTIVE, EXPIRED, VALIDATION_TIMED_OUT, REVOKED, FAILED)                                                                                                                                                                                                                                          |
| extended_key_usage   | array  | No | - | Filter by the Extended Key Usage X.509 v3 extension (TLS_WEB_SERVER_AUTHENTICATION, TLS_WEB_CLIENT_AUTHENTICATION, CODE_SIGNING, EMAIL_PROTECTION, TIME_STAMPING, OCSP_SIGNING, IPSEC_END_SYSTEM, IPSEC_TUNNEL, IPSEC_USER, ANY, NONE, CUSTOM)                                                                                                                              |
| key_types            | array  | No | - | Filter by algorithms used to generate key pairs (RSA_1024, RSA_2048, RSA_3072, RSA_4096, EC_prime256v1, EC_secp384r1, EC_secp521r1)                                                                                                                                                                                                                                         |
| key_usage            | array  | No | - | Filter by Key Usage X.509 v3 extension (DIGITAL_SIGNATURE, NON_REPUDIATION, KEY_ENCIPHERMENT, DATA_ENCIPHERMENT, KEY_AGREEMENT, CERTIFICATE_SIGNING, CRL_SIGNING, ENCIPHER_ONLY, DECIPHER_ONLY, ANY, CUSTOM)                                                                                                                                                                |
| sort_by              | string | No | - | Specifies the field to sort results by (CREATED_AT)                                                                                                                                                                                                                                                                                                                         |
| sort_order           | string | No | - | Specifies order to sort results by (ASCENDING, DESCENDING)                                                                                                                                                                                                                                                                                                                  |

### Secrets (Static Credentials Only)

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| **Access Key** | string | Conditional | AWS Access Key ID |
| **Secret Key** | string | Conditional | AWS Secret Access Key |

> ⚠️ **Authentication**: Choose either Role ARN (recommended) or static credentials. See [AWS Authentication Guide](./index.mdx#authentication-methods) for setup instructions.

## Sample Record

```json
{
  "CertificateArn": "3b2bd830-d5f1-2087-a0c9-fd2d839639dd",
  "CreatedAt": "2025-08-11T23:46:55.690781Z",
  "DomainName": "app.monad.com",
  "Exported": true,
  "ExtendedKeyUsages": [
    "SERVER_AUTH"
  ],
  "HasAdditionalSubjectAlternativeNames": true,
  "ImportedAt": null,
  "InUse": false,
  "IssuedAt": "2025-08-11T23:46:55.690862Z",
  "KeyAlgorithm": "RSA_1024",
  "KeyUsages": [
    "CERTIFICATE_SIGNING"
  ],
  "NotAfter": "2025-08-11T23:46:55.690894Z",
  "NotBefore": "2025-08-11T23:46:55.690895Z",
  "RenewalEligibility": "ELIGIBLE",
  "RevokedAt": null,
  "Status": "FAILED",
  "SubjectAlternativeNameSummaries": [
    "example.com",
    "app.monad.org"
  ],
  "Type": "IMPORTED"
}
```