A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of roles between the EC2 service administrators that are entitled to login to instances as well as making API calls and the security officers who will maintain and have exclusive access to the application’s X?

Explanations:

Storing the certificate in an S3 bucket may ensure restricted access, but it does not provide sufficient security for sensitive SSL certificates as S3 lacks robust encryption and security specifically for private key management.

While CloudHSM offers high security for sensitive keys, it is primarily for cryptographic operations and not for certificate retrieval. Additionally, managing SSL certificates directly through CloudHSM is impractical and complex.

System permissions on the servers alone are insufficient, as administrators with EC2 access could potentially alter permissions, allowing unauthorized access to certificates, failing the separation of roles requirement.

Terminating SSL on an ELB with IAM policies for security officers restricts certificate access to only those officers. ELB abstracts SSL handling, meeting security and separation of roles requirements effectively and securely.