A permit system needs TLS certificates for custom domains on an Application Load Balancer, CloudFront, and API Gateway. Which service should provision and renew those certificates?
Select an answer to reveal the explanation.
Short Explanation
ACM is the city’s certificate desk for HTTPS on ALB, CloudFront, and API Gateway—it issues and renews so you are not chasing paper expirations. Macie, GuardDuty, and Snowball are great at other jobs, but they are not your TLS shop.
Full Explanation
TLS certificates for custom domains on an Application Load Balancer, CloudFront, and API Gateway should be provisioned and renewed with AWS Certificate Manager (ACM). ACM issues certificates (and can automatically renew them) for integrated AWS endpoints, removing much of the manual CSR/expiry toil that municipal web teams face across permit, parks, and open-data hostnames.
Amazon Macie generating X.509 certificates from spreadsheet uploads fails because Macie discovers and classifies sensitive data in S3—it is not a public certificate authority or ACM replacement. Amazon GuardDuty signing browser certificates during threat findings fails conceptually: GuardDuty produces security findings; it does not operate as a TLS certificate issuer for citizen HTTPS. Mailing USB sticks of private keys via AWS Snowball fails because physical key shipment is operationally risky, unscalable for renewals, and unrelated to ACM’s managed certificate lifecycle for ALB/CloudFront/API Gateway.
Exam caveat: CloudFront typically requires certificates in us-east-1 for custom domains, while regional ACM certificates apply to regional ALBs—region mismatch is a common exam and operations trap. Operational check: request or import certificates in the correct regions, attach them to ALB listeners, CloudFront distributions, and API Gateway custom domains, enable DNS validation automation, and alert on upcoming expirations for any imported (non-ACM-renewed) certificates.