A developer is creating a regional custom domain name for an Amazon API Gateway REST API. They request an AWS Certificate Manager certificate for the branded hostname, but when configuring the custom domain in API Gateway the certificate does not appear in the selection list. The API and its stage are deployed in the eu-west-1 Region. In which Region must the certificate be requested so it can be attached to this regional custom domain name?
- AIn us-east-1, because API Gateway custom domain certificates are always served from that Region regardless of where the API and its stage are deployed.
- BIn any Region that supports ACM, because API Gateway can reference a certificate from a different Region as long as the certificate covers the branded hostname.
- CIn eu-west-1, the same Region as the API, because a regional custom domain name requires the ACM certificate to reside in the Region where the API is deployed. Correct
- DIn a Region geographically nearest to the API clients, because the certificate is chosen by latency and must match the closest edge location to the callers of the API.
Why A is wrong: The us-east-1 requirement applies to edge-optimised custom domains that use CloudFront, not to regional custom domains, so this misapplies the edge rule to a regional endpoint.
Why B is wrong: API Gateway cannot reference an ACM certificate across Regions for this purpose, so a certificate in an unrelated Region would still not appear in the selection list for the regional domain.
Why C is correct: A regional custom domain name terminates TLS in its own Region, so the certificate must be requested in eu-west-1 where the API lives, which is why a certificate from elsewhere does not appear in the list.
Why D is wrong: Certificate selection is not based on client latency or edge proximity, and regional domains do not use edge locations, so the nearest-Region idea has no bearing on which certificate is valid.