Does anyone have a recommended way of monitoring SAML cert expiry in AWS?

maybe you can use a cloudwatch syntetic?