A company manages public certificates in AWS Certificate Manager (ACM), including imported and ACM-issued certificates with mixed validation methods. A security engineer must design a monitoring solution that sends email alerts when a certificate is nearing expiration. What is the most operationally efficient approach?

The most operationally efficient approach leverages AWS-native services designed for this exact purpose. ACM integrates directly with Amazon EventBridge, which offers a predefined event pattern for "Certificate Approaching Expiration." This event is automatically triggered when an ACM certificate is nearing its expiration date, eliminating the need for custom code or manual checks. By setting an Amazon SNS topic as the target, email alerts are automatically sent. The other options are less efficient: A Lambda function with the AWS SDK would require writing, testing, and maintaining custom code, and it would incur costs for Lambda invocations and API calls. CloudWatch alarms on the DaysToExpiry metric would require manually adding each certificate ARN, which is not scalable or efficient for a large or dynamic certificate inventory. Security Hub is a security posture management service, not primarily designed for proactive certificate expiration monitoring, and configuring custom actions based on NotBefore (which indicates the start date, not expiration) would be incorrect and inefficient.