AWS Certificate Manager (ACM) Overview

• Purpose: ACM is used to provision, manage, and deploy SSL/TLS certificates for web applications and services.
• Main Use: These certificates are crucial for enabling HTTPS endpoints, thus providing in-flight encryption for websites, ensuring secure communication over the public internet.

Example Scenario

• You have an Application Load Balancer (ALB) connected via HTTP to an Auto Scaling group of EC2 instances.
• To expose HTTPS to end-users on the application, ACM is utilized.
• ACM, when linked to your domain, facilitates the provisioning and management of TLS certificates.
• These certificates are then loaded onto the ALB, enabling it to offer HTTPS endpoints for secure client communications.

Key Features of ACM

• Public and Private TLS Certificates: ACM supports both, with public TLS certificates provided free of charge.
• Automatic TLS Certificate Renewal: A highly beneficial feature that ensures certificates are always up to date without manual intervention.
• Integration with AWS Services: ACM certificates can be easily integrated with various AWS services, including:
  • Elastic Load Balancer (ELB)
  • CloudFront distributions
  • APIs on API Gateway

Summary

• ACM's Role in AWS DevOps: It is instrumental in securing web applications and services by facilitating easy management and deployment of SSL/TLS certificates.
• Benefits:
  • Ensures secure, encrypted communication over the internet.
  • Automates the renewal process, reducing the administrative burden.
  • Seamlessly integrates with key AWS services for comprehensive security coverage.

Whenever considering services for in-flight encryption and certificate management within AWS, ACM should be top of mind.

Amazon-issued certificates can’t be installed on an EC2 instance. To enable end-to-end encryption for the given use case, you must use a third-party SSL certificate which should be installed on the EC2 instances.

ACM does not provide certificates for anything other than the SSL/TLS protocols.