Aws/acm Diagnostics

Read-only diagnostics for AWS Certificate Manager issuance and validation problems. Reports per-domain validation status, the exact DNS CNAME records ACM expects, failure reasons, and which resources still use a certificate, for many certificates in one call.

Authentication

Uses the default AWS credential chain. Set the optional profile global argument to resolve credentials from a named AWS shared-config profile (SSO token cache / fromIni), enabling multi-account use within a single swamp repo. Only ListCertificates and DescribeCertificate are called, so a read-only profile is sufficient.

Required IAM Permissions

• acm:ListCertificates
• acm:DescribeCertificate

Usage

swamp model create @webframp/aws/acm-diagnostics acm-prod \
  --global-arg region=us-east-1 --global-arg profile=prod-account

# Find certificates stuck waiting on validation
swamp model method run acm-prod list_certificates \
  --input 'statuses=["PENDING_VALIDATION","VALIDATION_TIMED_OUT"]'

# Which domain failed validation, and what record does ACM want?
swamp model method run acm-prod describe_certificates \
  --input 'certificateArns=["arn:aws:acm:us-east-1:123456789012:certificate/00000000-0000-0000-0000-000000000000"]'

Methods

• list_certificates - List certificates, filtered by status and domain substring
• describe_certificates - Fan-out DescribeCertificate over many ARNs: validation status per domain, expected DNS records, failure reason, in-use resources, plus a roll-up of pending, in-use, missing, and errored certificates. Fails if no certificate could be described.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.10.13.1

Added: Initial release. Read-only ACM diagnostics: list_certificates (status and domain filters) and describe_certificates (per-domain validation status, expected DNS records, failure reason, in-use resources, and a roll-up of pending, in-use, missing, and errored certificates).