An ALB terminates HTTPS.
Automate renewal of a public certificate without distributing the certificate to EC2 instances.
Which architecture is most appropriate?
Issue a certificate with AWS Certificate Manager and associate it with the ALB so renewal and distribution are managed.
Detailed explanation
A TXT record does not terminate TLS or encrypt application traffic.
A TXT record does not terminate TLS or encrypt application traffic.
An S3 policy does not manage the ALB certificate.
An S3 policy does not manage the ALB certificate.
ACM-managed certificates can be attached to the ALB, reducing renewal and distribution work.
ACM-managed certificates can be attached to the ALB, reducing renewal and distribution work.
This expands private-key exposure and creates more update work.
This expands private-key exposure and creates more update work.
Check official documentation
Compare the following points with the official documentation.
AWS Certificate ManagerとApplication Load Balancer HTTPSの公式説明を確認する。
What to confirm
TLS終端箇所と証明書管理サービスを対応付けられる。
Key points
- AWS Certificate Manager
- ALB
- TLS termination
Notes
- Environment: AWS公式ACM・ELBドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Centralized termination
Terminating TLS at the ALB avoids distributing private keys to every instance.
Managed renewal
ACM reduces manual renewal work when the certificate is associated with supported resources.