How to fix Error: Error creating ACM Certificate: LimitExceededException in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 127 views

AWS ACM limits the number of certificates you can request per year. This error occurs when you exceed your account's certificate quota or domain limit. Resolve it by requesting a quota increase or reusing existing certificates.

Quick fix

Fixes LimitExceededException

aws acm list-certificates --region us-east-1
  1. Check your current ACM certificate count
  2. Review your Terraform state for duplicate resources
  3. Reduce domains per certificate if needed
  4. Request an AWS quota increase
terraform — error
aws acm list-certificates --region us-east-1
Error: Error creating ACM Certificate: LimitExceededException

What this error means

AWS Certificate Manager (ACM) enforces quota limits to prevent abuse and manage resource allocation. When you hit a LimitExceededException, it means your AWS account has reached one of two types of limits: 1. **Certificate count limit**: By default, you can request 2,500 certificates per account. You can request up to 5,000 certificates in any 365-day period (twice your account quota). 2. **Domains per certificate limit**: Each ACM certificate can have a default maximum of 10 domain names (Subject Alternative Names). This can be increased up to 100 with a quota increase request. When Terraform attempts to create an ACM certificate and hits this limit, AWS returns a LimitExceededException error and the `aws_acm_certificate` resource creation fails.

Typical symptoms

  • Terraform apply fails with 'LimitExceededException' error message
  • The error may mention 'Certificate has too many domains' if you have many SANs
  • The error may indicate 'you have reached your limit of X certificates in the last year'
  • Creating the same certificate manually in AWS console works, but Terraform fails
  • Previously applied Terraform configurations suddenly fail without code changes

Common causes

  1. You have requested more certificates in the past 365 days than your account limit allows (default: 5,000 per year)
  2. Your AWS account has reached its total certificate quota (default: 2,500 certificates)
  3. Your certificate has too many domain names (Subject Alternative Names) configured, exceeding the per-certificate limit
  4. Terraform is creating duplicate certificates because state was lost or not properly persisted
  5. Your Terraform state file is out of sync with actual AWS resources

How to fix "Error: Error creating ACM Certificate: LimitExceededException"

1Check your current ACM certificate count

Log into your AWS Console and navigate to AWS Certificate Manager. Count how many certificates you currently have, or use the AWS CLI:

bash
aws acm list-certificates --region us-east-1

This shows all certificates in the specified region. Note that ACM quotas are per-region per-account, so you'll need to check multiple regions if you use them.

2Review your Terraform state for duplicate resources

Check if Terraform is trying to create duplicate certificates:

bash
terraform state list | grep aws_acm_certificate

If the certificate already exists in state but you're getting an error, try:

bash
terraform refresh

This updates your state file to match actual AWS resources. If the certificate exists in AWS but not in your Terraform state, import it:

bash
terraform import aws_acm_certificate.example <certificate-arn>

Get the certificate ARN from the AWS Console under Certificate Manager.

3Reduce domains per certificate if needed

If your error message says "Certificate has too many domains", you're hitting the per-certificate domain limit. Split your domains across multiple certificates:

Instead of:

hcl
resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  subject_alternative_names = [
    "api.example.com",
    "app.example.com",
    "cdn.example.com",
    # ... many more domains
  ]
  validation_method = "DNS"
}

Use wildcards or split into multiple certificates:

hcl
resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  subject_alternative_names = ["*.example.com"]
  validation_method = "DNS"
}

resource "aws_acm_certificate" "secondary" {
  domain_name       = "another.com"
  subject_alternative_names = ["*.another.com"]
  validation_method = "DNS"
}
4Request an AWS quota increase

If you legitimately need more certificates or domains, request a quota increase:

1. Go to AWS Service Quotas console: https://console.aws.amazon.com/servicequotas
2. Search for "Certificate Manager"
3. Find the quota you need to increase:
 - "Number of certificates per account" (currently 2,500)
 - "Domain names per ACM certificate" (currently 10, max 100)
4. Click on the quota, then "Request quota increase"
5. Enter your desired value
6. Submit the request

AWS typically approves quota increases within minutes to hours. You'll receive an email confirmation.

5Delete unused certificates to free up quota

If you don't need an increase, free up quota by deleting unused certificates:

bash
# List certificates in AWS Console or via CLI
aws acm list-certificates --region us-east-1

# Delete a specific certificate (via Console)
# Note: You cannot delete a certificate in use by other AWS services

Certificates deleted within the past 365 days still count against your yearly quota. If you're concerned about quota, requesting an increase is faster than waiting for the 365-day window to pass.

6Verify quota increase and retry

Once your quota increase is approved, retry your Terraform deployment:

bash
terraform plan
terraform apply

If using CI/CD, ensure your pipeline has the latest AWS credentials with proper IAM permissions to create ACM certificates.

Advanced notes

Why Terraform may create duplicate certificates: If your Terraform state file is stored locally or not properly persisted in a remote backend, Terraform loses track of created certificates. Each time you run terraform apply, it thinks the certificate doesn't exist and tries to create a new one. Always use a remote state backend (S3 + DynamoDB, Terraform Cloud, etc.) for production.

Multi-region considerations: ACM quotas are per-region. A certificate created in us-east-1 doesn't count toward quotas in us-west-2. However, if you're managing infrastructure across many regions, your global quota can still be exceeded.

Certificate lifecycle: Unlike some services, deleted ACM certificates still count toward your yearly quota for 365 days. This is to prevent abuse (repeatedly creating and deleting certificates). Plan your certificate strategy accordingly.

Wildcard certificates: Using wildcard domains (*.example.com) is a good way to reduce the number of domain entries per certificate without hitting the per-certificate domain limit.

Frequently asked questions

What does "LimitExceededException" mean?
AWS Certificate Manager (ACM) enforces quota limits to prevent abuse and manage resource allocation. When you hit a LimitExceededException, it means your AWS account has reached one of two types of limits: 1. Certificate count limit: By default, you can request 2,500 certificates per account.
How do I fix "LimitExceededException"?
AWS ACM limits the number of certificates you can request per year. This error occurs when you exceed your account's certificate quota or domain limit. Resolve it by requesting a quota increase or reusing existing certificates.
What causes "LimitExceededException"?
You have requested more certificates in the past 365 days than your account limit allows (default: 5,000 per year) Your AWS account has reached its total certificate quota (default: 2,500 certificates) Your certificate has too many domain names (Subject Alternative Names) configured, exceeding the per-certificate limit
Is the "LimitExceededException" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading