A platform team runs many internal services that authenticate each other with mutual TLS. The certificates should come from the company's own private certificate hierarchy and do not need to be trusted by public browsers. Which AWS service fits?
Show answer and explanation
Answer: C
ACM Private CA lets a company operate its own certificate authority hierarchy, including subordinate CAs that can chain to an existing on-premises root. Certificates issued from it are trusted by clients that trust the private root, which suits internal mTLS. Public ACM certificates chain to public roots, KMS manages keys rather than certificates, and Secrets Manager stores secret values.
Why the other options are wrong
- A. Public ACM certificates are trusted through public root authorities and cannot be issued from a company-controlled private hierarchy for internal services.
- B. KMS manages cryptographic keys for encryption and signing. It does not issue X.509 certificates for services.
- D. Secrets Manager stores and rotates secret values. It is not a certificate authority and cannot sign certificates for mutual TLS.