Back to Checks
aws

IAM server certificate is not expired

iam_no_expired_server_certificates_stored
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCertificateManagerCertificate

IAM server certificates stored in AWS IAM are evaluated for expiration by comparing their validity period to the current time. Certificates with a NotAfter date in the past are identified as expired.

Prowler logoProwlerprowler-provider-aws

Risk

Retaining expired TLS certificates risks availability loss from failed handshakes and browser warnings, eroding trust.

If attached to endpoints, users may bypass warnings, weakening confidentiality and integrity. Stale certs also hinder secure rotation and may be picked by automation, causing outages.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_no_expired_server_certificates_stored

Recommendation

Remove expired certificates from IAM and ensure endpoints use current, trusted TLS.

Prefer AWS Certificate Manager for issuance and auto-renewal, enforce lifecycle management with inventory, tagging, and alerts, and apply least privilege to certificate access with standardized rotation policies.

Remediation

CLI

aws iam delete-server-certificate --server-certificate-name <CERTIFICATE_NAME>

Other

1Deleting IAM server certificates is not supported in the AWS Management Console.
2Use the CLI to remove the expired certificate: aws iam delete-server-certificate --server-certificate-name <CERTIFICATE_NAME>

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_no_expired_server_certificates_stored(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for certificate in iam_client.server_certificates:
            report = Check_Report_AWS(metadata=self.metadata(), resource=certificate)
            report.region = iam_client.region
            expiration_days = (datetime.now(timezone.utc) - certificate.expiration).days
            if expiration_days >= 0:
                report.status = "FAIL"
                report.status_extended = f"IAM Certificate {certificate.name} has expired {expiration_days} days ago."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"IAM Certificate {certificate.name} is not expired."
                )
            findings.append(report)

        return findings

References