Terraform AWS ACM

ACM certificates and validation records for public or private TLS, certificate renewal, and associations used by load balancers, CloudFront distributions, and APIs.

Controls enforced

These compliance controls are checked at terraform plan time.

ACM certificates should not use wildcard certificates(medium effort)
ACM RSA certificates should use a key length of at least 2,048 bits(low effort)
ACM certificates should have transparency logging enabled(low effort)

Quick start

module "acm" {
  source  = "nis2.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

module "acm" {
  source  = "soc2.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"
}

module "acm" {
  source  = "soc2.compliance.tf/terraform-aws-modules/acm/aws"
  version = ">= 6.0.0, < 7.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

3 Incident handling

ACM certificates should have transparency logging enabled

9 Cryptography

ID.RA-1

ACM RSA certificates should use a key length of at least 2,048 bits

PR.DS-02

ACM certificates should have transparency logging enabled

ISM-0472: Using Diffie-Hellman

ACM RSA certificates should use a key length of at least 2,048 bits

ISM-1327: Generating and issuing certificates for authentication

ACM RSA certificates should use a key length of at least 2,048 bits

Detection

ACM certificates should have transparency logging enabled

A.8.24 Use of cryptography

ACM certificates should not use wildcard certificates

3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.

ACM RSA certificates should use a key length of at least 2,048 bits

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

ACM certificates should not use wildcard certificates

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	PCI DSS v4.0	SOC 2
ACM certificates should not use wildcard certificates	○	●
ACM RSA certificates should use a key length of at least 2,048 bits	●	○
ACM certificates should have transparency logging enabled	○	○

● enforced by default · ○ not activated by this endpoint