A developer is creating an application that includes an Amazon API Gateway REST API in the us-east- 2 Region. The developer wants to use Amazon…

To use a custom domain name with an Amazon CloudFront distribution, the associated SSL/TLS certificate must be located in AWS Certificate Manager (ACM) in the US East (N. Virginia) us-east-1 Region. This is a specific requirement for CloudFront, regardless of the location of the origin service (in this case, API Gateway in us-east-2). After importing the certificate into ACM in us-east-1 and configuring the CloudFront distribution, you must create a DNS CNAME record. This record maps your custom domain to the CloudFront distribution's domain name (e.g., d111111abcdef8.cloudfront.net), directing user traffic through CloudFront to the API.

A. The certificate must be in the us-east-1 Region for CloudFront, not the same region as the API. An A record is also incorrect for pointing to a CloudFront domain name.

B. SSL/TLS certificates are not imported directly into CloudFront. They must be imported into AWS Certificate Manager (ACM) and then associated with the CloudFront distribution.

C. The certificate must be in the us-east-1 Region for CloudFront. Importing it into the same region as the API (us-east-2) is incorrect for this architecture.

1. AWS Certificate Manager User Guide: Under the section "Regions for AWS Certificate Manager

" the documentation states

"To use an ACM certificate with Amazon CloudFront

you must request or import the certificate in the US East (N. Virginia) Region."

2. Amazon CloudFront Developer Guide: In the "Using HTTPS with CloudFront" section

under "Requirements for using SSL/TLS certificates with CloudFront

" it specifies

"To use a certificate from a third-party CA with CloudFront

you must import the certificate into ACM in the US East (N. Virginia) Region."

3. Amazon API Gateway Developer Guide: In the section "Setting up a custom domain name for an edge-optimized API

" the guide explains the process which involves creating a CloudFront distribution and then states

"After you create the custom domain name

you must set up a DNS record to map the custom domain name to the CloudFront distribution domain name." This mapping is typically done with a CNAME record.