6.5.7 AWS Certificate Manager

Configure AWS CLI credentials, region, and in-place certificate replacement

The AWS ACM Import template calls the AWS CLI to import a PEM certificate, private key, and intermediate chain.

Requirements

  • Install the AWS CLI on the Linux agent host.
  • Configure credentials for the account that owns the target ACM certificate.
  • Configure the intended AWS region. ACM certificates are regional, except certificates used by CloudFront, which must be in us-east-1.
  • Grant the agent identity acm:ImportCertificate and any additional permissions required by your credential-management process.

Test the same runtime identity and region used by the CertKit agent. A successful command in another user’s shell does not confirm that the service account is configured.

Replace the existing certificate in place

The unmodified template creates a new ACM certificate on every run. Existing ALB, CloudFront, API Gateway, or other service associations do not move automatically to a new ARN.

For a renewable production deployment, customize the command to include the ARN of the existing imported certificate:

aws acm import-certificate \
  --certificate-arn "arn:aws:acm:REGION:ACCOUNT:certificate/ID" \
  --certificate "fileb://$CERT_PATH" \
  --private-key "fileb://$KEY_PATH" \
  --certificate-chain "fileb://$CHAIN_PATH"

AWS then replaces the certificate material while preserving the ARN and its service associations.

Common failures

  • Unable to locate credentials: configure credentials for the account running the agent.
  • Resource not found: confirm the ARN and CLI region match.
  • Access denied: grant acm:ImportCertificate on the target certificate or appropriate account scope.
  • Malformed certificate or chain: use the template’s PEM certificate, key, and chain format without adding the root certificate to the server chain.