-1

We had set up a common ALB as a single point of entry to all systems, We wanted to drop traffic at ALB when the SSL cert was not renewed(expired) by the individual system teams.

We have a 3rd part DDOS services that have automatic cert updates and it reflects the cert as valid but not the ALB Cert as the cert was not updated.

Internet -> DDOS services -> ALB -> Systems

I wonder if there's a way to deny traffic if the SSL cert is expired?

Desmond
  • 5,001
  • 14
  • 56
  • 115

1 Answers1

0

You can use an AWS config rule for the AWS_CERTIFICATE_EXPIRATION_CHECK event that triggers an SNS topic when the cert has expired (0 days to expiration).

The SNS topic can trigger a lambda function which removes/alters the security group rule that allows traffic from the security group associated with the ALB.

Paolo
  • 21,270
  • 6
  • 38
  • 69