Find and Delete Unused ACM Certificates

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListCertificates",
      "Effect": "Allow",
      "Action": "acm:ListCertificates",
      "Resource": "*"
    },
    {
      "Sid": "DescribeCertificates",
      "Effect": "Allow",
      "Action": "acm:DescribeCertificate",
      "Resource": "arn:aws:acm:*:111122223333:certificate/*"
    },
    {
      "Sid": "DeleteOnlyWithApply",
      "Effect": "Allow",
      "Action": "acm:DeleteCertificate",
      "Resource": "arn:aws:acm:*:111122223333:certificate/*"
    }
  ]
}

// find-unused-acm-certificates.ts
// Lists ACM certificates of every key type and status in the given Regions (us-east-1 is always included,
// because CloudFront uses certificates from there), confirms with DescribeCertificate that nothing uses them,
// and sorts them into "delete" (expired, failed, timed out, revoked, inactive) and "review" (issued but unused).
// --apply deletes the "delete" group; add --include-issued to also delete unused issued certificates.
// Usage:
//   npx tsx find-unused-acm-certificates.ts [--regions eu-west-1,us-east-1]
//   npx tsx find-unused-acm-certificates.ts --regions eu-west-1 --apply [--include-issued]
import {
  ACMClient,
  CertificateStatus,
  DeleteCertificateCommand,
  DescribeCertificateCommand,
  KeyAlgorithm,
  paginateListCertificates,
  type CertificateSummary,
} from "@aws-sdk/client-acm";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = [...new Set([
  ...(flag("--regions") ?? process.env.AWS_REGION ?? "").split(",").map((r) => r.trim()).filter(Boolean),
  "us-east-1",
])];
const apply = args.includes("--apply");
const includeIssued = args.includes("--include-issued");
const DEAD = new Set<string>(["EXPIRED", "FAILED", "VALIDATION_TIMED_OUT", "REVOKED", "INACTIVE"]);
const DAY = 86_400_000;

interface Finding {
  region: string;
  arn: string;
  Region: string;
  Domain: string;
  Type: string;
  Status: string;
  Expires: string;
  Action: "delete" | "review";
  Why: string;
}

const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
const day = (d?: Date): string => (d ? d.toISOString().slice(0, 10) : "-");

async function scanRegion(region: string): Promise<Finding[]> {
  const acm = new ACMClient({ region });
  const summaries: CertificateSummary[] = [];
  const input = {
    CertificateStatuses: Object.values(CertificateStatus),
    Includes: { keyTypes: Object.values(KeyAlgorithm) }, // the default returns RSA_2048 only
  };
  for await (const page of paginateListCertificates({ client: acm }, input)) {
    summaries.push(...(page.CertificateSummaryList ?? []));
  }
  const findings: Finding[] = [];
  for (const s of summaries) {
    if (!s.CertificateArn || s.InUse) continue;
    const cert = (await acm.send(new DescribeCertificateCommand({ CertificateArn: s.CertificateArn }))).Certificate;
    if (!cert || (cert.InUseBy ?? []).length > 0) continue; // attached to a load balancer, distribution, API...
    if (s.ManagedBy) continue; // managed by another service (for example CloudFront); leave it alone
    const status = cert.Status ?? "?";
    const base = {
      region, arn: s.CertificateArn, Region: region, Domain: cert.DomainName ?? "?",
      Type: cert.Type ?? "?", Status: status, Expires: day(cert.NotAfter),
    };
    if (DEAD.has(status)) {
      findings.push({ ...base, Action: "delete", Why: `not in use, ${status.toLowerCase().replace(/_/g, " ")}` });
    } else if (status === "PENDING_VALIDATION") {
      const age = cert.CreatedAt ? Math.floor((Date.now() - cert.CreatedAt.getTime()) / DAY) : 0;
      findings.push({ ...base, Action: "review", Why: `pending validation for ${age} days` });
    } else if (status === "ISSUED") {
      const why = cert.Type === "IMPORTED"
        ? "imported, not attached to an AWS resource (may be used elsewhere)"
        : s.Exported
          ? "exported: may be installed outside AWS"
          : "issued, not attached: ACM won't renew it";
      findings.push({ ...base, Action: "review", Why: why });
    }
  }
  return findings;
}

async function main(): Promise<void> {
  const all: Finding[] = [];
  for (const region of regions) all.push(...(await scanRegion(region)));
  console.table(all.map(({ region: _r, arn: _a, ...row }) => row));
  const toDelete = all.filter((f) => f.Action === "delete" || (includeIssued && f.Why.startsWith("issued, not attached")));
  console.log(`${all.length} unused certificates in ${regions.join(", ")}; ${toDelete.length} selected for deletion.`);
  if (!apply) {
    console.log("Report only: nothing was deleted. Add --apply to delete the 'delete' rows.");
    return;
  }
  for (const f of toDelete) {
    try {
      await new ACMClient({ region: f.region }).send(new DeleteCertificateCommand({ CertificateArn: f.arn }));
      console.log(`Deleted ${f.Domain} (${f.Status}) in ${f.region}`);
    } catch (err) {
      console.error(`Could not delete ${f.arn}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-acm
npm install --save-dev tsx typescript @types/node

# Report for eu-west-1 and us-east-1
AWS_PROFILE=readonly npx tsx find-unused-acm-certificates.ts --regions eu-west-1

# Delete expired, failed and timed-out certificates that nothing uses
AWS_PROFILE=certs-admin npx tsx find-unused-acm-certificates.ts --regions eu-west-1 --apply

┌─────────┬─────────────┬─────────────────────────┬─────────────────┬────────────────────────┬──────────────┬──────────┬─────────────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Domain                  │ Type            │ Status                 │ Expires      │ Action   │ Why                                                                 │
├─────────┼─────────────┼─────────────────────────┼─────────────────┼────────────────────────┼──────────────┼──────────┼─────────────────────────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'old.example.com'       │ 'AMAZON_ISSUED' │ 'EXPIRED'              │ '2026-03-02' │ 'delete' │ 'not in use, expired'                                               │
│ 1       │ 'eu-west-1' │ 'beta.example.com'      │ 'AMAZON_ISSUED' │ 'ISSUED'               │ '2027-02-11' │ 'review' │ "issued, not attached: ACM won't renew it"                          │
│ 2       │ 'eu-west-1' │ 'vpn.example.com'       │ 'AMAZON_ISSUED' │ 'ISSUED'               │ '2027-01-20' │ 'review' │ 'exported: may be installed outside AWS'                            │
│ 3       │ 'us-east-1' │ '*.staging.example.com' │ 'AMAZON_ISSUED' │ 'VALIDATION_TIMED_OUT' │ '-'          │ 'delete' │ 'not in use, validation timed out'                                  │
│ 4       │ 'us-east-1' │ 'legacy.example.com'    │ 'IMPORTED'      │ 'ISSUED'               │ '2026-12-01' │ 'review' │ 'imported, not attached to an AWS resource (may be used elsewhere)' │
└─────────┴─────────────┴─────────────────────────┴─────────────────┴────────────────────────┴──────────────┴──────────┴─────────────────────────────────────────────────────────────────────┘
5 unused certificates in eu-west-1, us-east-1; 2 selected for deletion.
Deleted old.example.com (EXPIRED) in eu-west-1
Deleted *.staging.example.com (VALIDATION_TIMED_OUT) in us-east-1