A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The c

ACM provides free, auto-renewing TLS certificates that integrate natively with Application Load Balancers, securing HTTP traffic in transit between clients and the application with zero certificate management overhead. Amazon RDS supports encryption at rest using AWS KMS, which can be enabled at creation time without additional infrastructure, satisfying both compliance requirements at the lowest operational cost.

Using third-party TLS certificates requires manual procurement, installation, and renewal across all EC2 instances, which significantly increases operational overhead compared to ACM-managed certificates.

AWS CloudHSM provides dedicated hardware security modules for strict compliance requirements but carries substantial cost (approximately $1.60/hour per HSM) and operational complexity far exceeding what is necessary for standard TLS termination.

Sending HTTP (unencrypted) connections from CloudFront to the origin EC2 instances fails to secure data in transit between the CDN and the application tier, violating the requirement that data must be secured in transit end-to-end.