A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of
roles between the EC2 service administrators that are entitled to login to instances as well as making API calls
and the security officers who will maintain and have exclusive access to the application’s X.509 certificate that
contains the private key.

A.
Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2 Role of
the web servers.

B.
Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by the
security officers.

C.
Configure system permissions on the web servers to restrict access to the certificate only to the authority
security officers

D.
Configure IAM policies authorizing access to the certificate store only to the security officers and terminate
SSL on an ELB.

Explanation:
You’ll terminate the SSL at ELB. and the web request will get unencrypted to the EC2 instance, even if the certs
are stored in S3, it has to be configured on the web servers or load balancers somehow, which becomes
difficult if the keys are stored in S3. However, keeping the keys in the cert store and using IAM to restrict
access gives a clear separation of concern between security officers and developers. Developer’s personnel
can still configure SSL on ELB without actually handling the keys.