ACM certificate should use DNS validation instead of email validation

What it checks

ACM certificate: uses email validation.

Where it applies

Terraform: aws_acm_certificate

CloudFormation: AWS::CertificateManager::Certificate

How to fix it

1. Request a replacement certificate with validation_method = "DNS"; an existing email-validated certificate cannot switch validation methods. Publish its validation CNAME with Route 53 or your public DNS provider, validate it, and update the service association before removing the old certificate. Automatic renewal requires an eligible certificate that remains in use and publicly resolvable validation CNAMEs.

Vendor documentation

All rules