Your organization imports SSL/TLS certificates from a third-party provider into AWS Certificate Manager (ACM) to use with public web apps. You must notify the security team 90 days before any imported certificate expires. The security team is subscribed to an existing Amazon SNS topic and there is an existing SQS queue. Which solution will reliably notify the security team 90 days before expiration?

The acm-certificate-expiration-check AWS Config managed rule specifically monitors ACM certificates and flags them as non-compliant if they are due to expire within a specified number of days (defaulting to 45, but configurable). By enabling this rule and setting it to run daily, AWS Config will automatically identify certificates approaching expiration. An Amazon EventBridge rule can then be configured to detect Config Rules Compliance Change events for this specific Config rule. When a certificate becomes non-compliant (i.e., within 90 days of expiration), EventBridge will trigger, sending a notification to the existing Amazon SNS topic, which then notifies the security team. Incorrect options: The ACM Certificate Approaching Expiration EventBridge event type is for managed ACM certificates, not imported ones. A Lambda function scanning for certificates would require custom code, scheduling, and error handling, making it less reliable and more complex than a managed service solution. Step Functions and CloudTrail are overly complex for this specific requirement and CloudTrail primarily logs API calls, not proactively monitors certificate expiration status.