SAA-C03 - Design Secure Architectures (30% of the exam) - Section 1.8

Protect data in transit using TLS, AWS Certificate Manager and secure connectivity options.

Describe how TLS secures data in transit and how AWS Certificate Manager provisions, manages, and auto-renews public and private certificates for use with HTTPS listeners on load balancers and CloudFront distributions. Recognise when a VPN connection or AWS Direct Connect with MACsec is required to encrypt traffic between on-premises networks and AWS.

TLSAWS Certificate ManagerHTTPS listenersVPN encryption

Practice question for this objective

Free sampleDesign Secure Architecturesmedium

An internal microservice mesh runs on EC2 inside a private VPC and must use TLS between services with certificates that chain to a private, company-controlled root rather than a public certificate authority. The team wants AWS to issue and manage these private certificates centrally. Which service should they use?

AAWS Secrets Manager, storing each service certificate as a secret and rotating it on a schedule for the internal mesh.
BAWS Key Management Service, creating a customer managed key per service to sign internal TLS certificates for the mesh.
CAWS Certificate Manager public certificates, requesting one per service and validating ownership of an internal-only domain name.
DAWS Private Certificate Authority, issuing private certificates from a company-controlled hierarchy for the internal services. Correct

Use AWS Private Certificate Authority to issue and manage private TLS certificates that chain to a company-controlled root. AWS Private Certificate Authority lets an organisation run a managed private certificate hierarchy and issue X.509 certificates for internal use such as service-to-service TLS, where certificates must chain to a private root rather than a public authority. Public ACM certificates require public domain validation and chain to public roots.

Why A is wrong: Secrets Manager can hold certificate material but does not issue certificates from a private certificate authority, so it cannot meet the issuance requirement.

Why B is wrong: KMS manages encryption keys and signing operations but does not act as a certificate authority that issues X.509 certificates for TLS.

Why C is wrong: Public ACM certificates require validation of a publicly resolvable domain and chain to public roots, so they do not fit an internal private root requirement.

Why D is correct: AWS Private Certificate Authority issues and manages private X.509 certificates from a private root the company controls, which is exactly what internal TLS between services needs.

See more SAA-C03 practice questions, answers explained.

Exam traps in Design Secure Architectures

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAA-C03 bank for this domain.

Attach an AWS WAF web access control list to the listener with a rule that inspects the client certificate header and blocks requests without a trusted issuer.
Why it is wrong: WAF inspects request attributes at Layer 7 but does not perform the TLS handshake or validate client certificates against a certificate authority, so it cannot enforce client authentication.
An Application Load Balancer with an HTTPS listener and an ACM certificate that terminates TLS and forwards the decrypted requests to the instances.
Why it is wrong: An Application Load Balancer operates at Layer 7 for HTTP and HTTPS, so it cannot front a custom non-HTTP TCP protocol even though it can use ACM certificates.
Provision an AWS Direct Connect dedicated connection between the data centre and the VPC, relying on its private link to keep the traffic encrypted by default.
Why it is wrong: Direct Connect provides a private path but is not encrypted on its own and needs longer provisioning, so it does not meet a low-cost fast-to-deploy encryption need.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.