expiredcertificate.yaml

---
queryId: Custom_AWS_Config_ACM_ExpiringCertificate
queryText: |-
  {
      source {
          LW_CFG_AWS_ACM_DESCRIBE_CERTIFICATE
      }
      filter {
          RESOURCE_CONFIG:Certificate.Status NOT IN ('EXPIRED') and
          DIFF_DAYS(current_timestamp_sec()::timestamp, RESOURCE_CONFIG:Certificate.NotAfter::timestamp) <= 20
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          'CertificateExpiringIn20DaysOrLess' as COMPLIANCE_FAILURE_REASON
      }
  }