The city wants api.city.gov as a custom domain on API Gateway and needs a publicly trusted TLS certificate that ACM can manage where regional API Gateway custom domains are supported. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Custom domains on API Gateway need a real public cert where folks already trust the chain — that is ACM's job in the right Region. Stick the public ACM cert on the regional custom domain and leave DIY PEMs and DynamoDB key stashes for another day.
Full Explanation
Regional API Gateway custom domains terminate TLS using ACM certificates that live in the same Region as the API. When the city needs api.city.gov as a publicly trusted hostname, the correct approach is to request or import a public ACM certificate in that Region and attach it to the regional custom domain name. Public ACM certificates integrate with browsers and municipal clients that already trust the public PKI chain, and ACM manages renewal so operators are not pasting PEMs into stage variables. This is the supported pattern for internet-facing civic APIs where residents and partners expect a normal trusted lock icon.
Issuing only a private certificate from AWS Private CA fails because private trust domains do not provide general public browser trust for api.city.gov; Private CA fits internal PKI, not citizen-facing hostnames. Pasting a self-signed PEM into an API Gateway stage variable fails conceptually—stage variables are not a TLS termination store, and self-signed certs break public trust. Storing the TLS private key in DynamoDB and having Lambda terminate TLS fails because it invents an unsupported, high-risk crypto path that bypasses ACM and API Gateway edge TLS.
Exam caveat: edge-optimized custom domains historically used ACM in us-east-1; regional custom domains need the cert in the API's Region—pick the model your exam scenario describes. Operational check: after attaching the ACM cert, resolve api.city.gov to the custom domain target, confirm the presented chain is publicly trusted, and document renewal alarms so municipal outages are not caused by an expired certificate.