AWS ACM

A CCF compliance plugin for AWS Certificate Manager (ACM). Fetches certificate data from ACM and evaluates OPA Rego policies to produce Evidence for the CCF API.

What the plugin checks is determined entirely by the policy bundles configured in the agent. The plugin itself is policy-agnostic — it fetches ACM certificate data and makes it available to whatever policies are loaded.

This page is for operators who run the plugin-aws-acm plugin with the CCF Agent, and for developers who write policies for it. It documents v0.1.1 and is generated from the plugin's README at v0.1.1.

Requirements

Required IAM permissions

{
  "Effect": "Allow",
  "Action": [
    "acm:ListCertificates",
    "acm:DescribeCertificate",
    "acm:ListTagsForCertificate"
  ],
  "Resource": "*"
}

Prerequisites

• Go 1.22+
• AWS credentials accessible via the standard SDK credential chain

Configuration

Key	Type	Default	Description
regions	string	required	Comma-separated list of AWS regions, e.g. us-east-1,eu-west-1
accounts	string	""	Comma-separated list of AWS account IDs to evaluate (optional)
policy_labels	JSON object	{}	Extra labels added to all Evidence entries

AWS credentials are resolved from the environment using the standard AWS SDK credential chain (environment variables, shared credentials file, instance profile, etc.).

Policies

The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.

Bundle	Latest version	Controls covered	Compatible plugin lines
plugin-aws-acm-certificate-policies	v0.1.1	A1.2, CC6.1, CC6.2, CC6.7, CC7.1, CC7.2, CC9.1	latest