Which ACM Certificate Lets CloudFront Use a Custom Domain for Free?

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

C Request a free Amazon-issued public ACM certificate in us-east-1 and attach it to the CloudFront distribution's alternate domain name.

Question

A company wants to configure its Amazon CloudFront distribution to use SSL/TLS certificates. The company does not want to use the default domain name for the distribution. Instead, the company wants to use a different domain name for the distribution. Which solution will deploy the certificate without incurring any additional costs?
  1. Request an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
  2. Request an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
  3. Request an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region. Correct Answer
  4. Request an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.

Key Takeaways

The question tests two linked constraints at once — the certificate must be public (browsers must trust it) and it must live in us-east-1 — and the trap is that a private certificate sounds 'more secure' or that a public certificate in another Region would work.

Amazon CloudFront requires an ACM public certificate issued in the us-east-1 Region before you can attach a custom (alternate) domain name to a distribution. Because ACM-issued public certificates cost nothing, requesting one in us-east-1 is the only option that delivers a custom domain with no additional certificate spend.

Common mistake: Choosing a private ACM certificate (option A or B). Private certificates are issued by AWS Private CA, are only trusted inside your VPC/account, and are billed monthly, so they neither satisfy browser trust for a public CloudFront endpoint nor meet the 'no additional cost' requirement.

Expert Analysis

Why the Answer Is Correct

CloudFront terminates TLS at edge locations using a certificate you attach to an alternate domain name (CNAME), and AWS explicitly requires that this certificate be an ACM public certificate requested or imported in the US East (N. Virginia) us-east-1 Region. Option C satisfies both constraints: it is a public certificate, so viewers' browsers trust it automatically without distributing a custom CA root, and it is requested in us-east-1, the only Region CloudFront reads certificates from. Crucially, the question also asks for no additional cost, and AWS states that public SSL/TLS certificates provisioned through ACM are free — you pay only for the resources running your application. A private certificate, by contrast, is issued through AWS Private Certificate Authority and carries a recurring per-certificate and per-CA charge, which immediately violates the cost constraint even before the trust problem is considered.

Why the Other Options Are Wrong

Option A pairs the correct Region (us-east-1) with the wrong certificate type: an Amazon-issued private certificate comes from AWS Private CA, is not trusted by public browsers, and incurs monthly CA and certificate fees, so it fails both the custom-domain HTTPS requirement and the no-extra-cost requirement. Option B fails on both axes as well — it is private (not browser-trusted, not free) and it is in us-west-1, a Region CloudFront does not source certificates from. Option D has the right certificate type but the wrong Region; a public ACM certificate in us-west-1 simply cannot be selected in the CloudFront console for an alternate domain name, so the deployment would fail even though the certificate itself is free. Only C satisfies the Region constraint, the public-trust constraint, and the zero-marginal-cost constraint simultaneously.

Community Comment Notes

Every learner vote on this page landed on C (100 votes), and the reasoning is consistent with the AWS documentation. KennethNg923 summarized it neatly, noting you have to use the us-east-1 Region for ACM and that it must be a public SSL/TLS certificate for the domain. LeonSauveterre framed it as a memorization point: for CloudFront distributions with custom domain names, ACM public certificates must be requested from us-east-1. BatVanyo quoted the CloudFront developer guide, which says you must "request (or import) the certificate in the US East (N. Virginia) Region" when using an ACM certificate with CloudFront. Scheldon and rondelldell anchored the cost half of the answer on the ACM pricing page, which states that public SSL/TLS certificates provisioned through ACM are free, while cloudee pointed out flatly that "Private CA is not free." JackyCCK argued for option A on a non-repudiation rationale, but that reasoning conflates public-key trust for browsers with private CA identity assurance; a private certificate would not be trusted by a public browser visiting the distribution.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question mentions CloudFront plus a certificate for a custom domain, immediately filter to ACM certificates requested in us-east-1, then use the word 'free' or 'no additional cost' to eliminate any private CA option. Private certificates are never the answer for CloudFront viewer-facing HTTPS because browsers do not trust the AWS Private CA root.

Frequently Asked Questions

Why can't a private ACM certificate from us-east-1 (option A) be used for CloudFront?

AWS Private CA certificates are trusted only by clients that import your CA, so public browsers reject them. They also incur recurring CA and certificate charges, breaking the no-additional-cost requirement.

Why must the ACM certificate for CloudFront be in us-east-1 specifically?

CloudFront is a global service whose control plane reads ACM certificates only from us-east-1 (N. Virginia); certificates from other Regions cannot be selected for an alternate domain name.

Does using an ACM public certificate with a CloudFront custom domain add cost?

No. Public SSL/TLS certificates provisioned through ACM are free; you pay only for the AWS resources that run your application, so option C satisfies the cost constraint.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. KennethNg923 👍 4 Answered C
    Have to use east-1 region for ACM, and it should be public SSL/TLS for domain, so it should be C
  2. Scheldon 👍 3 Answered C
    AnswerC Per AWS "Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application." https://aws.amazon.com/certificate-manager/pricing/?nc=sn&loc=3 But hence AWS is recommending to use US east 1 I think I would go with C Note We recommend that you use ACM to provision, manage, and deploy SSL/TLS certificates on AWS managed resources. You must request an ACM certificate in the US East (N. Virginia) Region. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html
  3. BatVanyo 👍 3 Answered C
    The certificate has to be public. The certificate has to be issued in us-east-1: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html "To use an ACM certificate with CloudFront, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1)."
  4. LeonSauveterre 👍 3 Answered C
    Yes, C. Just memorize that. For CloudFront distributions with custom domain names, ACM public certificates must be requested from us-east-1.
  5. rondelldell 👍 2 Answered C
    https://aws.amazon.com/certificate-manager/pricing/ AWS Certificate Manager Pricing Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application. If you manage AWS Private Certificate Authority (CA) through ACM, refer to the AWS Private CA Pricing page for more details and examples.
Show 4 more comments
  1. sandordini 👍 2 Answered C
    browsers trust public certificates automatically by default > C or D To use an ACM certificate with Amazon CloudFront, you must request or import the certificate in the US East (N. Virginia) region [Nowhere is it stated why is this though...] > C
  2. cloudee 👍 2 Answered C
    This should be C. Private CA is not free
  3. JackyCCK 👍 1
    CloudFront should have a private cert and browser use public cert aiming to achieve non-repudiation. Ans should be A
  4. boluwatito 👍 3 Answered C
    It is c

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide