The city wants api.city.gov as a custom domain on API Gateway and needs a publicly trusted TLS certificate that ACM can manage where regional API Gateway custom domains are supported. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Custom domains on API Gateway need a real public cert where folks already trust the chain — that is ACM's job in the right Region. Stick the public ACM cert on the regional custom domain and leave DIY PEMs and DynamoDB key stashes for another day.
Full Explanation
Regional API Gateway custom domains use ACM certificates in the same Region as the API. Public ACM certificates are the supported path for internet-facing city hostnames such as api.city.gov. Private CA certificates serve private trust domains, not general public browser trust. Self-signed PEMs in stage variables or application-level TLS termination with keys in DynamoDB are unsupported and insecure patterns for this requirement.