How to Request an ACM Certificate for an App in Another AWS Account?
A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account. A CloudOps engineer needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account. What must the CloudOps engineer do to meet this requirement?
Community Insight
The question tests cross-account ACM certificate ownership and DNS validation; the trap is assuming that centrally managed Route 53 also means the certificate should be requested in the shared account.
An ACM certificate must be requested in the development account where the application runs, while Route 53 DNS validation records can be created in the shared account's hosted zone. This page confirms option C and explains why centralizing the certificate in the shared account does not work.
Choosing B because Route 53 is managed centrally; ACM certificates are account-scoped and a certificate in the shared account cannot be used by the development account's application resources.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
ACM certificates are scoped to the AWS account that requests them; for a load balancer, API Gateway, or other regional resource in the development account, the certificate must be in that same account and region. Route 53 is only used to publish the DNS validation CNAME, so the hosted zone can remain in the shared account. The engineer requests the certificate in the development account, copies the CNAME validation name and value that ACM provides, and creates the record in the relevant shared-account hosted zone. Once validation completes, the development account owns a usable certificate, while the shared account continues to own DNS.Why the Other Options Are Wrong
Option B places the certificate in the shared account, which breaks the account-bound relationship between the certificate and the development application; centralized Route 53 management does not make ACM certificates shareable across accounts. Options A and D introduce AWS KMS keys, but public ACM certificates do not use a customer-managed KMS key for DNS validation, and a Route 53 validation record does not reference a KMS key ARN. Option D also puts the KMS key in the wrong account and then tries to wire it into a DNS record, which is not how ACM validation works. Option A's KMS key policy grant to the development account root principal has no role in issuing an ACM certificate for the application.Community Comment Notes
Bad_Mat states the same resolution: request the certificate with ACM from the development account and create the validation record sets in the shared account's Route 53 hosted zone. That matches the account-bound certificate model and confirms the practical manual DNS-validation workflow across accounts. The comment does not raise a conflicting interpretation, so there is no community dispute to reconcile.Official Reference
Exam Strategy
When DNS ownership and workload ownership are split across accounts, first place the certificate with the resource that will use it, then handle validation where the DNS zone lives. Eliminate any option that introduces KMS, because public ACM certificate DNS validation does not use KMS keys.
Frequently Asked Questions
Why can't the ACM certificate be requested in the shared account?
ACM certificates are account-scoped; a certificate in the shared account cannot be attached to the development account's application resources. The shared account only supplies the Route 53 validation records.
Do the Route 53 hosted zone and ACM certificate need to be in the same account?
No. ACM DNS validation only needs a CNAME record in the public hosted zone; the zone can belong to a different account, as long as the validation record is created there.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →