Which AWS service integrates with the Amazon API Gateway to provision and renew TLS encryption needs for data in transit?

AWS Certificate Manager (ACM) directly integrates with Amazon API Gateway to provision public TLS certificates, enabling encrypted data-in-transit for API endpoints. ACM handles the full certificate lifecycle including automated renewal, removing the need for manual certificate management. This integration ensures that API Gateway custom domain names are protected with valid, up-to-date TLS certificates without operational overhead.

AWS Key Management Service (KMS) manages cryptographic keys for encrypting data at rest and in application workflows, but does not provision or renew TLS certificates for transit encryption.

AWS WAF (Web Application Firewall) filters and monitors HTTP/S requests for malicious traffic but has no role in managing TLS certificates or handling encryption provisioning.

AWS Security Token Service (STS) issues temporary, limited-privilege credentials for IAM identities and has no function related to TLS certificate provisioning or renewal.