Introduction ─ One checkbox, a $430 bill
For years, AWS Certificate Manager (ACM) public certificates have been treated as a service that is "free as long as you attach them to ALB / CloudFront". We had been requesting them routinely across multiple systems, and it was supposed to be a practically risk-free, everyday operation.
Recently, as part of some domain cleanup work, I asked a team member to request certificates. A few days later I checked Cost Explorer and saw USD 430 on the Certificate Manager line. I had no idea where it came from. Thinking "isn't this supposed to be free?", I opened the billing breakdown, and only then did I realize that the certificates had been issued with the Exportable option turned on.
After we explained the situation to AWS Support and requested a refund, they refunded the full USD 430 as credits (3 business days from opening the case to the decision). I'm publishing this as a heads-up for anyone who might hit the same problem, and as a reference if you already have. That said, I want to stress that refunds are at AWS's discretion, and a full refund is by no means promised in every case.
1. What happened ─ 10 certificates and the $430 breakdown
| Usage Type | Unit price (at the time) | Count | Subtotal |
|---|---|---|---|
APN1-IssueExportablePublicCertificateDomain1 FQDN (Exportable ON) | $7.00 | 5 | $35.00 |
APN1-IssueExportablePublicCertificateWildcardDomain1 wildcard (Exportable ON) | $79.00 | 5 | $395.00 |
| Total (only the certificates unintentionally issued as Exportable) | $430.00 | ||
The wildcard price of $79 hurts the most. Because we assumed certificates were free, we had casually created several *. domains.
2. What is an ACM Exportable Public Certificate?
ACM was originally designed around the idea that "public certificates cost nothing extra as long as you use them with AWS services". As long as a certificate was integrated with ALB / CloudFront / API Gateway and the like, the private key stayed entirely under AWS's control, and the service was free.
Exportable Public Certificate is a relatively new option, added on June 17, 2025. It offers, as a "paid" feature, the ability to "export the certificate itself, including the private key, so you can use it on on-premises or EC2-hosted web servers, other clouds outside AWS, and so on".
| Type | Regular (Exportable OFF) | Exportable ON |
|---|---|---|
FQDN (e.g. api.example.com) | $0 | $7 |
Wildcard (*.example.com) | $0 | $79 |
Note that the prices at the time of writing (May 2026), $7 per FQDN / $79 per wildcard, are roughly half of the launch prices in June 2025, which were $15 per FQDN / $149 per wildcard. The cut came in February 2026, when AWS shortened the maximum validity of public certificates from 395 days to 198 days, and prices were lowered roughly in proportion. The backdrop is the CA/Browser Forum policy (a maximum of 200 days from March 2026, shrinking in stages to a maximum of 47 days by 2029). Since shorter validity means more reissues per year, I read the design as keeping the annual cost roughly flat when you look at "unit price × reissues per year". Prices may drop again as validity periods are shortened further.
Most other AWS services are billed hourly (EC2 / NAT Gateway / RDS / ALB, etc.), so if you stop or delete the resource as soon as you notice an abnormal charge, the damage is limited to minutes or hours. It's a world where "notice → stop → limit the damage" actually works.
Exportable Public Certificates, by contrast, are charged upon issuance in AWS's own wording ── the per-certificate fee ($7 / $79) is locked in the moment the certificate passes DNS validation (or email validation) and reaches the "ISSUED" state. Note that the charge is triggered not when you submit the request, but when validation completes and the certificate is issued.
In theory, you can avoid the charge by "submitting the request → deleting it before validation completes". However, DNS validation completes automatically within minutes to tens of minutes after the CNAME propagates, and email validation within tens of seconds to a few minutes, so unless you're sitting in front of the screen waiting for it, you won't make it in time. Once a certificate reaches ISSUED, deleting it immediately afterward won't reverse the charge already incurred.
In our case, we deleted all 10 certificates as soon as we found out, but the $430 remained on the bill (the fact that AWS Support later granted us a full refund as credits is a separate matter, and it is not guaranteed every time). "A paid, charged-on-issuance option slipped into a service everyone assumes is free" ── this double structure was the biggest factor that made the damage so severe.
3. Anatomy of the incident ─ The UI and the "it's free" assumption
Reason 1. The UI (no confirmation dialog)
First, some context: at the time of the incident, the default for "Allow export" in the ACM console was "Disable export", and the user had to explicitly select the "Enable export" option to turn it on. In other words, it wasn't "switched on by default without anyone noticing" ── in our case, the user selected it, turning it ON, and the certificates were issued that way.
The problem is that when you select "Enable export" and issue the certificate, there is no pricing confirmation dialog or inline warning along the lines of "If you continue, you will be charged $XX per certificate". The description under "Enable export" only says, in small print, "ACM charges your account based on the requested domains when the certificate is first issued and each time it is renewed". With no specific amount ($7 / $79) and no warning color, it's easy to miss that this is a paid option unless you read carefully.
*.example.com). The moment you press "Request" on this screen, you are on the hook for $79 per wildcard.The pricing page and the official AWS documentation do describe the billing conditions, but the console does little to make you notice at the moment you're actually clicking. After you submit the request, the moment DNS validation (or email validation) completes and the certificate reaches ISSUED, the "Enable export" choice the user made quietly turns into a charge.
Reason 2. Assuming it was free, my instructions were too loose
ACM had long been used as a service where "everything is free, from requesting a certificate to attaching it to an ALB", so we simply had no habit of pausing to think about cost. I, as the requester, hadn't even noticed that a new "Allow export" section had been added to the request screen.
As a result, when I delegated the task, I just said "please issue certificates in ACM", without mentioning that the Exportable option existed or that turning it on triggers an immediate charge. The team member ended up facing the ACM request screen without the background information they needed.
Loose instructions from a requester who never questioned "ACM = free" put the team member in front of a UI trap without the information they needed ── that is the heart of this incident.
I see it not so much as the team member's mistake, but as a failure of oversight on my part as the requester.
4. Timeline from discovery to refund
Asked a team member to issue certificates for domain cleanup (no heads-up about Exportable)
As part of the domain cleanup work, I asked a team member to issue ACM certificates. All I said was "please issue FQDN and wildcard certificates in ACM"; I didn't explain beforehand that the Exportable option existed, what ON / OFF meant, or how it was priced. On the ACM console request screen, the team member issued 10 certificates (5 FQDN + 5 wildcard) with the Exportable option left ON. Five regular public certificates issued on a separate occasion had been issued for free with the option OFF, and the task was reported to me as successfully completed.
Spotted "Certificate Manager $430" in Cost Explorer ─ deleted the certificates and opened a support case the same day
While reviewing the monthly cost trend, I found an unfamiliar APN1-IssueExportablePublicCertificate* line and USD 430. The billing breakdown pointed to the Exportable option as the cause. I immediately deleted all 10 certificates and, the same day, opened a refund request with AWS Support under the "Billing / request a correction to charges" category.
AWS notified us that "the full USD 430 will be issued as credits"
Three business days after opening the case, we received the reply: "After careful review by the responsible team, a credit for the full $430 has been approved." Since the month's bill hadn't been finalized yet, it was a simple matter of offsetting it with credits. The reply also noted that the credits could be viewed under AWS Billing Console > Credits.
Closed the support case
After confirming the refund, I replied with a thank-you and closed the case. It took 5 business days from opening to closing, and the case was filed with the severity "General guidance".
5. Preventing a recurrence ─ What we do at MOOBON
Because ACM Exportable Public Certificates use a billing model where the full fee is locked in at issuance, after-the-fact detection tools like Cost Anomaly Detection and AWS Budgets can't contain the damage.
The cleanest countermeasure would be to deny requests with the Exportable option enabled using an IAM / SCP condition key, but within the scope of our research we couldn't find a condition key that makes this possible. So at MOOBON, our main way of stopping it before issuance is operational: "make sure everyone on the team knows, and include a warning whenever we delegate the task".
Always include a warning when sharing or delegating the task internally
If the person doing the work has no prior knowledge of Exportable, they have "no way of noticing" the UI trap, so it has to be closed off as part of the requester's oversight responsibility. Whenever we share or delegate ACM certificate issuance internally, our rule is to always include a note about the Exportable option.
- Always include the line "Issue the certificate with Exportable left OFF" in the request
- Keep the whole team aware that the Exportable option exists and that "the full fee is locked in at issuance"
- Make it a habit to cross-check via screen sharing or screenshots before and after the operation
Afterword
In contrast to MOOBON's AWS cost optimization article, this is a record of a blunder from the "paid without noticing" side. As long as AWS keeps adding features, I think we'll keep seeing paid options slipped into services everyone assumes are free. I published this article in the hope that "it prevents even one more incident like ours".
For day-to-day cost management, what really works is a monthly habit of looking through Cost Explorer's view by usage type. Since charged-on-issuance traps can't be contained by after-the-fact detection, what makes the difference is whether you regularly look at what's on your bill and catch sudden anomalies early.
And if you do fall into the trap, don't give up right away ── try contacting AWS Support. If you have AI organize the facts for you, the case description comes together quickly, so it's less work than you might think. There's no guarantee of a full refund like ours, but they will at least hear you out.
If you want to take a serious look at your AWS cost structure itself, check out MOOBON's AWS cost analysis tool and our companion article, How we cut $310/month in AWS fixed costs. For cost assessments or architecture reviews, feel free to reach out at info@moobon.jp.
Frequently Asked Questions
QWhat is the difference between an ACM Exportable Public Certificate and a regular public certificate?
Regular public certificates, which ACM has always offered, cost nothing extra as long as you attach them to AWS services such as ALB or CloudFront. An Exportable Public Certificate, on the other hand, is a paid option that lets you export the certificate along with its private key so you can use it outside AWS. At the time of this incident, the issuance fee in the Tokyo region was USD 7 per FQDN and USD 79 per wildcard (AWS may revise these prices, so check the official AWS pricing page for current rates).
QDoes the ACM console warn you about charges before you enable the Exportable option?
At the time of this incident, the request screen showed no clear pop-up or inline warning that enabling Exportable would incur an additional fee. The pricing page and the official AWS documentation do mention it, but the console itself does little to make you realize, right before you click, that issuing the certificate this way will cost money. Anyone operating under the assumption that ACM is free can easily issue certificates with the option left on without noticing. AWS may have changed the UI since then, so please verify on the actual screen.
QIf I accidentally issued certificates with Exportable enabled, will deleting them stop the charges?
Unfortunately, no. Exportable Public Certificates are billed per certificate, and the fee is locked in the moment the certificate is issued; deleting it right afterward won't reverse a charge that has already been incurred. With hourly-billed services like EC2 or NAT Gateway, you can usually limit the damage to minutes or hours by stopping the resource once you notice. ACM Exportable is unusual in that by the time you notice, the full amount has already been booked. Ideally you would deny requests with the Exportable option enabled via an IAM / SCP condition key, but within the scope of our research we couldn't find a suitable one. That's why, at MOOBON, our primary safeguard is operational: whenever we share or delegate this task internally, we always include a warning about the Exportable option. In the case described in this article, we explained the situation to AWS Support and received a full refund as credits (whether a refund is granted is at AWS's discretion and is never guaranteed).
QWhich AWS Support plan do I need to request a refund?
Billing inquiries (billing cases) can be opened free of charge on any support plan: Basic, Developer, Business, or Enterprise. Technical questions require a paid plan, but a billing question or correction request like ours worked fine on the Basic plan. Whether a refund is granted is AWS's call and the outcome is not guaranteed, so don't build your operations around the assumption that asking will always get your money back.
QWhat is the minimum you would recommend to prevent this from happening again?
Because ACM Exportable locks in the full fee at issuance, after-the-fact detection tools like Cost Anomaly Detection and AWS Budgets can't contain the damage. Ideally you would deny requests with the Exportable option enabled via an IAM / SCP condition key, but within the scope of our research we couldn't find a suitable one. So at MOOBON, our way of stopping it before issuance is a strict rule: whenever we share or delegate this task internally, we always include a warning about the Exportable option. Concretely, we've built three practices into our operations: always add the line "Issue the certificate with Exportable left OFF" to the request; keep the whole team aware that the option exists and that its full fee is locked in at issuance; and make it a habit to cross-check via screen sharing before and after the operation.
