TLS must protect service-to-service traffic for an internal-only domain.
Use an organization-controlled certificate authority and automate certificate management.
Which service combination is most appropriate?
Use AWS Private CA for the internal PKI and AWS Certificate Manager to issue and manage private certificates for the services.
Detailed explanation
DNS records are not a safe secret store or a certificate-authority service.
DNS records are not a safe secret store or a certificate-authority service.
Private CA provides the internal trust hierarchy and ACM manages private certificate issuance and lifecycle.
Private CA provides the internal trust hierarchy and ACM manages private certificate issuance and lifecycle.
A password is not an X.509 certificate and cannot establish TLS identity.
A password is not an X.509 certificate and cannot establish TLS identity.
S3 Lifecycle transitions and expires objects; it does not issue or manage certificates.
S3 Lifecycle transitions and expires objects; it does not issue or manage certificates.
Check official documentation
Compare the following points with the official documentation.
AWS Private CAとACM private certificateの公式説明を確認する。
What to confirm
公開証明書と内部証明書の発行・管理を使い分けられる。
Key points
- AWS Private CA
- AWS Certificate Manager
- Private certificate
Notes
- Environment: AWS公式ACM Private CAドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Internal PKI
Private CA supplies the trust hierarchy, while ACM handles certificate issuance and lifecycle for integrations.
Secret-key protection
A DNS record is not a safe place to store a private key or manage certificate trust.