RSA certificates managed by ACM should use a key length of at least 2,048 bits

How to fix it

Set at creation: fixing it means replacing the resource.

Replace the named certificate with one whose RSA key is at least 2,048 bits. Key length is fixed at issue or import, so obtain the replacement, move every listener, distribution and API off the old certificate, and only then delete it. The finding clears when the old certificate is gone, not when the replacement appears, so the cited command is the first step rather than the fix. Expect the short key to have arrived by import: certificates ACM issues already meet the bar.

In the console

Certificate Manager → Certificates → Request certificate → Key algorithm

With the AWS CLI

aws acm request-certificate --domain-name <domain-name> --validation-method DNS --key-algorithm RSA_2048 --region <region>

With Terraform

resource "aws_acm_certificate" "this" {
  domain_name       = var.domain_name
  validation_method = "DNS"
  key_algorithm     = "RSA_2048"
}