Question

A company runs a public-facing REST API behind an Application Load Balancer (ALB). Security requires that the TLS private key used to terminate connections is never exportable or accessible to administrators, and that certificate renewal happens automatically without operator intervention. The team currently uses a certificate issued by a public third-party certificate authority that they trust. Which approach best meets all requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) for the domain and associate it with the ALB listener, allowing ACM to manage the private key and renewal.

Answer

Import the existing third-party certificate and private key into ACM and associate it with the ALB, relying on ACM to rotate the key automatically.

Answer

Store the third-party private key in AWS Secrets Manager, enable automatic rotation, and reference the secret from the ALB listener configuration.

Answer

Upload the certificate and private key to IAM as a server certificate and attach it to the ALB, using IAM access policies to prevent administrators from reading the key.