Question

A financial services company runs a fleet of internal microservices on EC2 instances behind internal Application Load Balancers within a private VPC. Security policy requires mutual TLS between all internal services using X.509 certificates issued by a certificate authority the company controls. The certificates must be short-lived and automatically renewed, and the CA's root must NOT be publicly trusted. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Private CA (ACM Private CA) as the internal root/subordinate hierarchy, issue certificates through ACM for the ALBs, and distribute the private CA root to services for trust validation.

Answer

Use AWS Certificate Manager (ACM) public certificates for each service and configure the internal ALBs to require client certificates.

Answer

Store self-signed certificates in AWS Secrets Manager and configure a Lambda rotation function to replace them every 24 hours on each service.

Answer

Purchase certificates from a third-party public CA and import them into ACM, then attach them to the internal ALBs for mutual TLS.