RSA certificates managed by ACM should use a key length of at least 2,048 bits

How to fix it

• Replaces the resource: The key cannot change: request or import a replacement, move every load balancer, distribution and API to it, then delete this certificate, which is what clears the finding.

In the console

Certificate Manager → Certificates → Request certificate → Key algorithm

Key algorithm

RSA 2048, or an ECDSA algorithm if every service that will use the certificate supports it

With the AWS CLI

aws acm request-certificate --domain-name <domain-name> --validation-method DNS --key-algorithm RSA_2048 --region <region>

With Terraform

resource "aws_acm_certificate" "this" {
  domain_name       = var.domain_name
  validation_method = "DNS"
  key_algorithm     = "RSA_2048"
}