Question

A developer is deploying a customer-facing web application behind an Application Load Balancer (ALB). The security team requires that all traffic between clients and the application be encrypted in transit using TLS, and that the TLS certificate be automatically renewed before expiration to avoid outages. The developer wants the least amount of operational overhead. What should the developer do?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) and associate it with an HTTPS listener on the ALB.

Answer

Purchase a certificate from a third-party CA, store the private key in AWS Secrets Manager, and manually attach it to the ALB each year.

Answer

Enable server-side encryption with SSE-KMS on the ALB target group to encrypt traffic to the backend instances.

Answer

Generate a self-signed certificate on each EC2 instance and configure the ALB to forward TLS traffic without termination.