AWS Certificate Manager (ACM)

What it is

AWS Certificate Manager (ACM) handles creating, storing, and renewing public and private TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry X.509 certificates and keys that protect your AWS websites and applications. Certificates can cover a single domain, several specific domains, wildcard domains (an unlimited number of subdomains), or combinations of these. Public certificates issued by ACM for integrated services have no additional charge.

Choose ACM when a question asks how to get HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry certificates for a load balancer, CloudFront, or API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway, or how to stop certificates from expiring without manual work.

Concepts

Integrated services: Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS App Runner, and others. ACM deploys and renews the certificate on the service for you.
Validation: prove you control the domain with DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry validation (a CNAME (Canonical name record)A DNS record that makes one domain name an alias of another, such as www.example.com pointing to example.com. A CNAME cannot be used for the zone apex (example.com itself); Route 53 alias records cover that case.Glossary entry, which enables automatic renewal) or email validation.
Managed renewal: ACM renews Amazon-issued certificates automatically when DNS validation is in place; otherwise it emails you before expiry.
Regional: certificates are Regional resources. For an ALB, request the certificate in the ALB's AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry. For CloudFront, the certificate must be in US East (N. Virginia), us-east-1.
Imported certificates: bring certificates from a third-party CA (Certificate authority)A trusted organization or service that issues digital certificates, vouching that a public key belongs to a named domain or organization. Browsers trust certificates signed by well-known CAs; AWS Private CA issues certificates for internal use.Glossary entry. ACM doesn't renew imported certificates: you obtain a new one and reimport it.
Certificates on your own servers:
- Exportable public certificates let you deploy ACM-issued public certificates anywhere, including EC2 instances, containers, and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry hosts.
- ACM also supports the ACME protocol to automate issuance and renewal of publicly trusted certificates on customer-managed infrastructure, such as Kubernetes or on-premises servers.
Private certificates: issue private certificates for internal services from AWS Private Certificate Authority (AWS Private CA), a managed private CA. Private CA certificates can also be exported for use anywhere in your internal PKI.

Security, resilience, performance, and cost

Security: ACM protects the private keys of integrated certificates; use EventBridge events and CloudWatch metrics to watch for approaching expirations, especially for imported certificates.
Resilience: automatic renewal prevents outages caused by expired certificates.
Cost: no additional charge for public SSL/TLS certificates used with integrated services. Exportable public certificates and AWS Private CA have their own charges.

ACM or another option?

If the requirement is	Choose
HTTPS on an ALB, CloudFront, or API Gateway with automatic renewal	ACM public certificate
Custom domain on CloudFront	ACM certificate in us-east-1
Certificates for internal services and devices	AWS Private CA (with ACM)
Public certificate on an EC2 web server	ACM exportable public certificate or ACME
Certificate from another CA that we already own	Import into ACM (renew manually)
Keys for encrypting data	AWS KMS

Reverse mindmap: when the question points here

Is it AWS Certificate Manager?

Yes, when the question says
- Free TLS certificate for a load balancer leads to ACM public certificate
- Certificates expire and break the site leads to ACM managed renewal with DNS validation
- HTTPS for many subdomains leads to ACM wildcard certificate
Know the rules
- Certificate for CloudFront leads to Request in us-east-1
- Certificate for an ALB leads to Same Region as the ALB
- Imported certificate expiring leads to Reimport manually, monitor with EventBridge
Beyond integrated services
- TLS on EC2 or on premises leads to Exportable public certificates or ACME
- Internal private certificates leads to AWS Private CA
No, when the question says
- Encrypt data at rest leads to KMS

Key takeaways

ACM provisions and renews public and private TLS certificates; public certificates for integrated services are free.
Use DNS validation so certificates renew automatically; ACM doesn't renew imported certificates.
Certificates are Regional; CloudFront needs its certificate in us-east-1.
Integrated services include ELB, CloudFront, and API Gateway; exportable public certificates and ACME cover your own servers.
AWS Private CA issues private certificates for internal use.