AWS Certificate Manager

AWS Certificate Manager (ACM) is a managed service that provisions, manages, and deploys X.509 TLS certificates for use with AWS resources and internal services. It provides APIs and a console to request public certificates from Amazon’s certificate authority or to import third-party certificates, and can automate renewal and deployment for supported AWS integrations when configured. ACM typically sits in the control plane to deliver certificates to edge or regional services that terminate TLS.

🗂 Resource Category

Security, Identity, and Compliance • Networking and Content Delivery

🧠 Exam Memory Hook

Think: "Managed TLS issuance + automatic renewal for AWS integrations = AWS Certificate Manager"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the ACM control plane, underlying physical infrastructure, networking, and managed runtime that issues and stores certificates; AWS is responsible for patching the physical infrastructure and the managed service platform and for the availability of ACM APIs and the managed certificate issuance process. When ACM issues managed public certificates, AWS handles certificate lifecycle operations such as issuance and, when configured, automatic renewal and replacement for supported AWS integrations. AWS does not manage customer application code, customer-deployed certificate import lifecycle, or customer-owned private PKI unless the customer uses additional managed services such as ACM Private CA.

Customer responsibilities: The customer configures certificate requests, chooses validation methods (DNS or email) and completes validation, manages permissions and IAM policies for certificate access, and attaches certificates to AWS resources. For imported certificates the customer is responsible for rotation and replacement before expiry and for securely storing private keys. When using private PKI, the customer configures the private CA and policies (if using ACM Private CA) and manages private certificate templates and usage.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the managed ACM runtime platform. Hypervisor and guest operating system patching are not applicable to customers because ACM is a managed control-plane service. Customers are responsible for patching their applications, application runtimes, libraries, dependencies, and any operating systems on compute resources where they install or use exported certificates.

🏗 Typical Architecture

💡 Top 5 Features

Provision public TLS certificates issued by Amazon’s certificate authority through the ACM control plane.
When configured with supported AWS services, automate certificate renewal and replace certificates on integrated endpoints.
Support importing and securely storing third-party X.509 certificates and private keys for use with AWS resources.
Provide API and console operations to request, list, describe, and delete certificates and to retrieve certificate metadata.
Integrate with IAM for access control and with other AWS services’ resource APIs to deploy certificates to endpoints.

✅ Top 5 Use Cases

Terminate TLS for internet-facing applications by deploying managed certificates to Elastic Load Balancers to reduce manual certificate lifecycle work.
Secure REST and WebSocket APIs by deploying certificates to Amazon API Gateway for TLS endpoint protection.
Deliver HTTPS-secured content through Amazon CloudFront using certificates managed in ACM to centralize certificate control.
Import third-party certificates into ACM to deploy existing CA-issued certificates to AWS resources while keeping private keys secure.
Manage private TLS certificates for internal services when used together with ACM Private CA to implement an internal PKI.

🏗 Architecture Placement

ACM operates as a control-plane certificate management service in an AWS account and is regionally scoped for most operations; administrators or automation create certificate requests and validation is completed by the customer. Integrated services such as Elastic Load Balancing, Amazon CloudFront, and API Gateway retrieve or reference certificates managed by ACM for TLS termination. Some integrations require certificates in a specific region depending on the consuming service configuration.

🎯 Commonly Used With

- Elastic Load Balancing
- Amazon CloudFront
- Amazon API Gateway
- AWS CloudFormation
- AWS Identity and Access Management

🌍 5 Real-World Examples

A retail web platform uses ACM to provision and automatically renew TLS certificates attached to Application Load Balancers to maintain HTTPS for customer checkout pages.
A banking API team deploys ACM-issued certificates to Amazon API Gateway endpoints to ensure encrypted connections for mobile banking clients.
A media company uses ACM certificates with Amazon CloudFront distributions to serve static assets over HTTPS and centralise certificate lifecycle operations.
A telecommunications operator issues private certificates via an ACM Private CA integration to authenticate internal service-to-service communication within a VPC.
A software vendor imports third-party code-signing or device certificates into ACM to distribute keys to managed load balancers and CDN endpoints while retaining private key control.

🎓 AWS Exam Clues

Choose ACM when you need managed TLS certificates with API/console lifecycle and integration with AWS endpoints.
Imported certificates require manual rotation by the customer, while ACM-managed certificates can be automatically renewed when supported integrations are used.
Use ACM Private CA (a separate service) when an organisation requires a private PKI for internal certificates rather than public CA-issued certs.
Domain validation is required for public certificates and can be completed using DNS validation or email validation depending on configuration.
ACM is an account-level service with regional endpoints; some consuming services may require certificates in a particular region or account.

📝 Quick Revision

ACM provisions, manages, and deploys X.509 TLS certificates for AWS resources and can automate renewals for supported integrations. Use when you want centralised certificate lifecycle and deployment to AWS endpoints; remember imported certificates and private CAs require customer-managed rotation and PKI configuration.

🏷 Keywords

TLS • X.509 • Certificate provisioning • Automatic renewal • Imported certificates • Domain validation • DNS validation • Email validation • ACM Private CA • Managed certificates • Certificate deployment • Certificate lifecycle