How to Request an ACM Certificate for an App in Another AWS Account?

SOA-C03 By islever Editorial Last updated Oct 20, 2026

Implement and manage security and compliance tools and policies. Configure domains, DNS services, and content delivery.

Short answer

C Request the ACM certificate in the development account, then create the DNS validation record sets in the shared account's Route 53 hosted zone.

Question

A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.
A CloudOps engineer needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account.
What must the CloudOps engineer do to meet this requirement?

Create a new AWS KMS key in the shared account. Configure the key policy to give read access to the development account's root principal.
Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone. Correct Answer
Create a new AWS KMS key in the development account. Configure the key policy to give read access to the shared account's root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.

Key Takeaways

The question tests cross-account ACM certificate ownership and DNS validation; the trap is assuming that centrally managed Route 53 also means the certificate should be requested in the shared account.

An ACM certificate must be requested in the development account where the application runs, while Route 53 DNS validation records can be created in the shared account's hosted zone. This page confirms option C and explains why centralizing the certificate in the shared account does not work.

Common mistake: Choosing B because Route 53 is managed centrally; ACM certificates are account-scoped and a certificate in the shared account cannot be used by the development account's application resources.

Expert Analysis

Why the Answer Is Correct

ACM certificates are scoped to the AWS account that requests them; for a load balancer, API Gateway, or other regional resource in the development account, the certificate must be in that same account and region. Route 53 is only used to publish the DNS validation CNAME, so the hosted zone can remain in the shared account. The engineer requests the certificate in the development account, copies the CNAME validation name and value that ACM provides, and creates the record in the relevant shared-account hosted zone. Once validation completes, the development account owns a usable certificate, while the shared account continues to own DNS.

Why the Other Options Are Wrong

Option B places the certificate in the shared account, which breaks the account-bound relationship between the certificate and the development application; centralized Route 53 management does not make ACM certificates shareable across accounts. Options A and D introduce AWS KMS keys, but public ACM certificates do not use a customer-managed KMS key for DNS validation, and a Route 53 validation record does not reference a KMS key ARN. Option D also puts the KMS key in the wrong account and then tries to wire it into a DNS record, which is not how ACM validation works. Option A's KMS key policy grant to the development account root principal has no role in issuing an ACM certificate for the application.

Community Comment Notes

Bad_Mat states the same resolution: request the certificate with ACM from the development account and create the validation record sets in the shared account's Route 53 hosted zone. That matches the account-bound certificate model and confirms the practical manual DNS-validation workflow across accounts. The comment does not raise a conflicting interpretation, so there is no community dispute to reconcile.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When DNS ownership and workload ownership are split across accounts, first place the certificate with the resource that will use it, then handle validation where the DNS zone lives. Eliminate any option that introduces KMS, because public ACM certificate DNS validation does not use KMS keys.

Frequently Asked Questions

Why can't the ACM certificate be requested in the shared account?

ACM certificates are account-scoped; a certificate in the shared account cannot be attached to the development account's application resources. The shared account only supplies the Route 53 validation records.

Do the Route 53 hosted zone and ACM certificate need to be in the same account?

No. ACM DNS validation only needs a CNAME record in the public hosted zone; the zone can belong to a different account, as long as the validation record is created there.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Bad_Mat 👍 1 Answered C

The correct answer is C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide