---
title: Expired SSL/TLS certificates should be removed from AWS IAM
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Expired SSL/TLS certificates should be
  removed from AWS IAM
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Expired SSL/TLS certificates should be removed from AWS IAM
 
## Description{% #description %}

AWS IAM server certificates should be removed after they expire. IAM does not delete expired SSL/TLS certificates automatically, and leaving them in place risks accidental deployment of invalid certificates to services such as Elastic Load Balancing or CloudFront. This rule fails any IAM-stored server certificate whose `Expiration` value, as returned by `aws iam list-server-certificates`, is in the past.

## Remediation{% #remediation %}

Update any services that still use the expired certificate to use a valid one. Because the AWS Management Console does not support removing IAM-stored certificates, delete the certificate with the CLI: `aws iam delete-server-certificate --server-certificate-name <CERTIFICATE_NAME>`. See [Managing server certificates in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html).

## References{% #references %}

- [AWS CLI: list-server-certificates](https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html)
- [AWS CLI: delete-server-certificate](https://docs.aws.amazon.com/cli/latest/reference/iam/delete-server-certificate.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)