DVA-C02 Question 173
Single answerYou are developing an application that needs to securely communicate with multiple internal microservices hosted on AWS. To enhance security, you decide to use mutual TLS for communication between the services. You also want to automate certificate issuance and renewal. Which solution would best meet these requirements?
- A
Use AWS Certificate Manager (ACM) to request public certificates and configure mutual TLS between the microservices.
- B
Set up AWS Private Certificate Authority (AWS Private CA) to issue private certificates and use them for mutual TLS between the microservices.
- C
Manually generate certificates using OpenSSL and distribute them to each microservice for mutual TLS.
- D
Use ACM to import third-party certificates and configure mutual TLS between the microservices.
Show answer and explanation
Correct answer: B
Explanation
AWS Private Certificate Authority (AWS Private CA) is the ideal solution for this use case because it enables the issuance of private certificates, which are suitable for internal communication. It integrates with ACM to provide automation for certificate management, including issuance and renewal, which simplifies the implementation of mutual TLS for secure communication between microservices.
- A. Incorrect.
AWS Certificate Manager (ACM) is primarily used for public certificates and does not support private certificates for internal mutual TLS directly. This option is not suitable for internal microservices requiring mutual TLS.
- B. Correct.
AWS Private Certificate Authority (AWS Private CA) allows you to issue private certificates, which are ideal for internal systems. It also integrates with ACM for automated certificate issuance and renewal, making it the best choice for this scenario.
- C. Incorrect.
Manually generating and distributing certificates with OpenSSL is error-prone and does not support automation for issuance and renewal. This approach is not scalable for larger systems.
- D. Incorrect.
ACM can import third-party certificates, but this option does not provide automation for issuance and renewal. It is also not the best choice for internal systems requiring mutual TLS.