What must the SysOps administrator do to meet this requirement?
Create a new AWS Key Management Service (AWS KMS) key in the shared account. Configure the key policy to give read access to the development account’s root principal.
Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
Create a new AWS Key Management Service (AWS KMS) key in the development account. Configure the key policy to give read access to the shared account’s root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.
Explanations:
Creating a new AWS KMS key in the shared account and configuring the key policy does not directly address the requirement for obtaining an SSL/TLS certificate, as KMS keys are not needed for certificate validation.
Requesting a new certificate using AWS Certificate Manager (ACM) from the shared account is appropriate since the hosted zones are managed in the shared account. Validation records can be created in Route 53 from the shared account to confirm domain ownership.
Requesting a new certificate using ACM from the development account is not feasible since the Route 53 hosted zones are managed in the shared account, making it impossible to create the necessary validation record sets for domain ownership.
Creating a new KMS key in the development account is irrelevant for obtaining an SSL/TLS certificate. Additionally, the key policy is not related to certificate validation, and using Route 53 from the shared account for validation record sets does not apply to KMS key configuration.
I surmise that the answer is:
Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.