Resources · n8n integration

AWS Certificate Manager n8n integrationAutomate AWS Certificate Manager with n8n.

Which certificate expires next, and who renews it? The AWS Certificate Manager n8n integration answers that from a workflow: 5 operations on one Certificate resource, to list with filters, read, read metadata, renew and delete. No trigger node ships with this tool, so a Schedule Trigger starts the run.

Try the AWS Certificate Manager integration on n8nSee the 5 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the AWS Certificate Manager n8n integration actually give you?

The AWS Certificate Manager node connects n8n to ACM, the AWS service that stores your SSL certificates. It exposes 5 operations on one resource, Certificate: get many, get one, get metadata, renew, delete. All five run through an AWS credential, a set of connection details you save once in n8n and pick from a dropdown in every workflow after that.

The first job most teams hand to this node is an expiry report nobody has to remember. A Schedule Trigger starts the workflow, certificate.getMany pulls the certificate list with Return All switched on, and the result lands somewhere a human will actually look: a channel through Slack, or a tracking tab through Google Sheets. The Certificate Statuses filter is what makes the report readable, since you can ask for EXPIRED and PENDING_VALIDATION and skip everything that is quietly healthy.

The second job is renewal with a human in the loop. A workflow posts the certificate to a channel, waits for someone to approve, then calls certificate.renew on the approved ARN. Nothing about that flow is special to AWS, which is the point: the approval step, the logging step and the renewal step are three nodes on one canvas.

The third job is inventory. certificate.getMetadata reads a single certificate by ARN, and the output gets written to a table in Postgres so the security review has something to read on Monday morning instead of a console tab. Pair it with certificate.delete and the same workflow also cleans up what a decommissioned domain left behind.

When an ACM call you need is not one of these 5 operations, reach for the HTTP Request node. It calls any endpoint of the API and reuses the very same AWS credential through predefined authentication, so you stay on one set of keys instead of inventing a second path.

Two limits are worth knowing before you build. With Return All off, the node stops at Limit, which is fine for a spot check and wrong for a full export. And a required field left empty blocks the node at execution time rather than at save time, so test with a real ARN. If you want to weigh the platform itself first, there is an n8n review, and a hands-on n8n training if the workflow above is the kind of thing your team wants to build without help.

Connect

How do you connect n8n to AWS Certificate Manager ?

  1. 01

    Create an access key in IAM

    Sign in to the IAM console, open your user name in the upper right, and pick Security credentials. In the Access keys section, choose Create access key, then pick your use case on the best practices page, or Other if nothing fits. Give the key a description tag such as n8n integration so you can tell it apart from the keys your infrastructure already uses, and reveal both values on the last screen.

  2. 02

    Save the AWS (IAM) credential in n8n

    In n8n, open Credentials and create an AWS (IAM) credential. Three values matter: your Region, the Access Key ID and the Secret Access Key you just revealed. If your keys are short-lived, turn on Temporary security credential and add the Session token that comes with them. Save once and every workflow in the instance can select it, including the ones you build later.

  3. 03

    Or assume a role instead of storing keys

    The AWS (Assume Role) credential authenticates by assuming an IAM role through AWS STS. The credentials n8n uses for the AssumeRole call are typed in by hand, or read automatically from the environment n8n runs in. That second option is the one to look at when you self-host n8n on AWS infrastructure such as EKS, ECS or EC2 and would rather not keep static keys inside the app at all.

Actions

The 5 operations the node runs on your certificates

The AWS Certificate Manager node exposes 5 operations across 1 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.

Resources × operations matrix
ResourceGetDeleteGet ManyGet MetadataRenew
Certificate✓✓✓✓✓

Certificate

5 operations
01

Delete a certificate

certificate.delete

What you see in n8n

Notes & use cases

Deletes a certificate in ACM. This is the only operation of the five that asks for more than an identifier: n8n wants three required values filled before it will run.

Key parameters

  • Certificate ARN: the ACM identifier, of the form arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012. When it comes from an earlier node, reference the value that node returns with an expression instead of pasting it in by hand.
  • Bucket Name: required by the operation, so the node refuses to execute while it is empty.
  • Certificate Key: the third required value, also blocking.
Use cases
a domain gets decommissioned and the certificate outlives it. A cleanup workflow lists what exists, keeps whatever is still serving traffic, and deletes the rest one item at a time.
02

Get a certificate

certificate.get

What you see in n8n

Notes & use cases

Reads one certificate from ACM, addressed by its ARN, and hands it to the next node in the workflow. One required field, nothing else to configure.

Key parameters

  • Certificate ARN: the full identifier, shaped like arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012. It is an ARN and not a domain name, so a workflow that only knows the domain has to look the certificate up first with Get Many.
Use cases
an alert names a certificate and a responder wants the detail without opening the console. The workflow takes the ARN from the alert payload, calls this operation, and posts the result back into the thread.
03

Get many certificates

certificate.getMany

What you see in n8n

Notes & use cases

Returns the certificate list from ACM. This is the operation you build reports on, because the Options collection narrows the list before it reaches the rest of the workflow.

Key parameters

  • Return All: on, n8n walks the API pages and brings back every certificate; off, it stops at Limit.
  • Certificate Statuses: 7 values to filter on, from ISSUED to REVOKED, EXPIRED or VALIDATION_TIMED_OUT.
  • Key Types: 6 algorithms, RSA_2048 and EC_prime256v1 among them.
  • Key Usage and Extended Key Usage: filter on the certificate extensions, for example TLS_WEB_SERVER_AUTHENTICATION.
Use cases
a weekly audit that only wants certificates in PENDING_VALIDATION, so the workflow stays quiet whenever nothing is stuck.
04

Get certificate metadata

certificate.getMetadata

What you see in n8n

Notes & use cases

Fetches the metadata of a single certificate. It takes the same single input as Get a certificate, so the difference lives entirely in what each one hands back: the certificate itself on one side, its metadata on the other.

Key parameters

  • Certificate ARN: the identifier of the certificate to describe, in the arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012 form. Feed it from a list step when the workflow loops over several certificates.
Use cases
an inventory job that walks the output of Get Many, calls this operation per item, and writes one row per certificate into a database for the security review.
05

Renew a certificate

certificate.renew

What you see in n8n

Notes & use cases

Triggers the renewal of a certificate in ACM. It is the one write operation in this node that changes state without removing anything, which makes it the natural last step after an approval.

Key parameters

  • Certificate ARN: the certificate to renew, in the arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012 form. Map it from the approval payload with an expression so nobody retypes an identifier by hand.
Use cases
a report flags a certificate, someone approves in a chat channel, and the workflow renews that exact ARN and logs who clicked.
Need help

Need help automating AWS Certificate Manager with n8n?

A person reads every message.

FAQ

AWS Certificate Manager and n8n, answered

01Is the AWS Certificate Manager n8n integration free?
Yes, on the n8n side. The node ships with n8n, so there is nothing to install and no extra n8n cost to unlock it. That holds on n8n Cloud, the hosted offer run by n8n, and on a self-hosted instance under the Community Edition and its Sustainable Use licence. A workflow built in one place behaves the same in the other, which matters if you prototype on Cloud and move to your own infrastructure later. What AWS charges on its side is a separate question and this page does not cover it. The only real prerequisite is an AWS account with credentials that can reach ACM.
02What AWS credentials does the n8n node need?
One of two credential types. AWS (IAM) authenticates with an access key: you save your Region, an Access Key ID and a Secret Access Key, and add a Session token if you turned on the temporary security credential option. AWS (Assume Role) authenticates by assuming an IAM role through AWS STS, and the credentials used for that AssumeRole call are either typed in or read automatically from the environment n8n runs in. If you self-host n8n on AWS infrastructure such as EKS, ECS or EC2 and want to avoid static keys in the app, the second type is the one to look at. Either credential is created once and reused across workflows.
03What are the limits of the AWS Certificate Manager node?
Two worth planning around. First, pagination: with Return All switched off on Get Many, the node stops at Limit, so a full export needs Return All on. Second, the catalog: the node covers 5 operations on the Certificate resource, and anything outside that goes through the HTTP Request node, which calls any endpoint of the API and reuses the same AWS credential through predefined authentication. There is no second set of keys to manage in that case. One practical detail: a required field left empty blocks the node at execution time, so test with a real ARN rather than a placeholder before you activate the workflow.
04Can n8n react in real time to a certificate change?
Not through a dedicated trigger, because this tool has no trigger node in n8n. A workflow that involves certificates starts with something else. The usual choice is the Schedule Trigger, which runs the workflow on a fixed interval, daily or hourly, and calls Get Many to see what changed. The alternative is the n8n Webhook node, a URL that a third-party service calls when something happens on its side, which works when another system already knows about the change. You can also hang the workflow off another tool's trigger, for example a message posted in a channel that asks for a renewal.
05n8n or Make for AWS Certificate Manager?
It depends on four things, and price is only one of them. Hosting: n8n self-hosts with Docker or npm, or runs on n8n Cloud, while Make is a hosted platform with no self-hosting option. Data control follows from that, since a self-hosted instance keeps certificate identifiers and logs on infrastructure you own. Cost model: Make bills per operation, which is worth simulating against a workflow that loops over every certificate in an account. Visual logic: both build on a canvas, and the choice there is a matter of taste more than capability. Try the same report workflow on both before committing.
Same platform

Other docs you might need on this stack.

Browse all integrations