An internal microservice mesh runs on EC2 inside a private VPC and must use TLS between services with certificates that chain to a private, company-controlled root rather than a public certificate authority. The team wants AWS to issue and manage these private certificates centrally. Which service should they use?
- AAWS Secrets Manager, storing each service certificate as a secret and rotating it on a schedule for the internal mesh.
- BAWS Key Management Service, creating a customer managed key per service to sign internal TLS certificates for the mesh.
- CAWS Certificate Manager public certificates, requesting one per service and validating ownership of an internal-only domain name.
- DAWS Private Certificate Authority, issuing private certificates from a company-controlled hierarchy for the internal services. Correct
Why A is wrong: Secrets Manager can hold certificate material but does not issue certificates from a private certificate authority, so it cannot meet the issuance requirement.
Why B is wrong: KMS manages encryption keys and signing operations but does not act as a certificate authority that issues X.509 certificates for TLS.
Why C is wrong: Public ACM certificates require validation of a publicly resolvable domain and chain to public roots, so they do not fit an internal private root requirement.
Why D is correct: AWS Private Certificate Authority issues and manages private X.509 certificates from a private root the company controls, which is exactly what internal TLS between services needs.