AWS ACM Certificates With Wildcard Domain Names
More Info:
Ensure that ACM single domain name certificates are used instead of wildcard certificates within your AWS account in order to follow security best practices and protect each domain/subdomain with its own unique private key. An AWS ACM wildcard certificate matches any first level subdomain or hostname in a domain. For example, a wildcard certificate issued for *.cloudconformity.com can protect both www.cloudconformity.com and images.cloudconformity.com.Risk Level
LowAddress
SecurityCompliance Standards
NISTTriage and Remediation
Check Cause
Using Console
Using Console
- Log in to the AWS Management Console and navigate to the API Gateway dashboard.
- In the APIs list, select the API you want to check.
- In the API’s settings, navigate to the “Custom Domain Names” section. Here, you will see a list of all custom domain names associated with your API.
- Check the ACM Certificate column for each custom domain name. If a certificate has a wildcard (*) in its domain name, it means that the certificate is configured with a wildcard domain name.
Using CLI
Using CLI
- First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the resources.
-
Once the AWS CLI is set up, you can use the following command to list all the ACM Certificates:
Replace ‘your-region’ with the region where your ACM Certificates are located. This command will return a list of all the ACM Certificates in the specified region.
-
To check if any of these certificates have wildcard domain names, you can use the following command:
Replace ‘your-certificate-arn’ with the ARN of the certificate you want to check and ‘your-region’ with the region where the certificate is located. This command will return the details of the specified certificate.
- In the output of the above command, look for the ‘DomainName’ field. If the value of this field starts with '', then the certificate has a wildcard domain name. For example, a value of ‘.example.com’ indicates a wildcard domain name.
Using Python
Using Python
-
Setup AWS SDK (Boto3) in Python Environment:
First, you need to set up AWS SDK (Boto3) in your Python environment. You can install it using pip:
After installing boto3, configure your AWS credentials. You can configure your credentials either by setting up environment variables or by using AWS CLI.
-
List ACM Certificates:
Use the
list_certificatesmethod provided by the ACM client in boto3 to list all the certificates. Here is a sample script:This script will print all the ACM certificates. -
Check for Wildcard Domain Names:
Now, iterate over the certificates and check if any certificate has a wildcard domain name. A wildcard domain name starts with ”*.”. Here is the updated script:
This script will print all the ACM certificates with wildcard domain names.
-
Check API Gateway for ACM Certificates:
Finally, check if any of the ACM certificates with wildcard domain names are used in API Gateway. Use the
get_rest_apismethod provided by the API Gateway client in boto3. Here is the final script:This script will print the names of all API Gateways that are using ACM certificates with wildcard domain names.