AWS ACM ACME over PrivateLink: Endpoint Setup, Private DNS, and Costs

What the private connection changes

AWS announced ACM support for public TLS certificate issuance through ACME over AWS PrivateLink on October 6, 2026. ACME clients in a VPC can reach ACM over the Amazon network, without configuring an internet gateway, NAT device, VPN, or AWS Direct Connect solely for this private client-to-ACM connection.

PrivateLink changes the network path to ACM; it does not turn a public certificate into a private CA certificate or make every workload dependency and target service private. The sections below separate endpoint choice, network prerequisites, authorization, certificate responsibilities, and billing.

Choose the ACM ACME endpoint by its job

com.amazonaws.region.acm-acme serves ACM ACME management operations for PKI administrators, such as creating ACME endpoints, domain validations, and external account bindings (EAB). com.amazonaws.region.acm-acme-enroll serves the ACME protocol that clients use to request and revoke certificates.

The two endpoint services are independent. The management endpoint does not provide the issuance protocol to clients, and the enrollment endpoint does not provide management operations. Each service requires its own VPC interface endpoint and endpoint policy, so choose based on which side needs private access to ACM from the VPC.

Check the Region, Availability Zone, and DNS prerequisites

The ACM ACME enrollment endpoint must be in the same Region as the configured ACME endpoint; generic PrivateLink cross-Region support does not override this service limitation. The original announcement covers AWS commercial Regions, but check support for the selected Availability Zone in the AWS Management Console before creating an endpoint.

Allow inbound TCP 443 to the enrollment endpoint from the VPC private subnet, and enable private DNS hostnames. With Amazon-provided DNS and Route 53, the existing ACME directory URL can resolve to the interface endpoint inside the VPC, so clients usually keep the same URL and configuration. Custom DNS requires conditional forwarding.

Separate endpoint policy from IAM identity policy

Before relying on the connection, a PKI administrator must create the ACME endpoint, preapprove the domains, configure the required CNAME records, and provide EAB credentials to the application team. ACM ACME issues only for domains the administrator has already validated; a private connection does not replace domain-ownership validation or grant issuance permission.

The IAM role associated with the EAB credentials participates in request authorization. The endpoint policy must cover the ACME endpoint resource for account registration, orders, authorizations, and downloads, and the certificate resource for finalization and revocation. Allowing only one resource type can leave the issuance flow incomplete.

An endpoint policy cannot identify the calling principal, so it does not replace an IAM identity policy. Each request must be allowed by both the endpoint policy and the IAM policy on the role associated with EAB. Use the role policy to restrict which principals can issue or revoke certificates, and check the required resource scopes against the official guide.

Confirm key ownership, renewal, and integration limits

ACM ACME certificates are publicly trusted TLS certificates. The ACME client generates and holds the private key; ACM never sees it. Certificates are valid for 45 days, and the ACME client requests renewal before expiry. ACM managed renewal does not apply, so the application team remains responsible for client availability, key custody, and rotation.

These certificates appear in the ACM inventory with standard ARNs, but they cannot be bound to ACM-integrated services such as Elastic Load Balancing, CloudFront, or API Gateway. The ACM ExportCertificate API is also unsupported for them. If you need ACM to manage the private key or renewal, or need an integrated-service binding, use the corresponding ACM certificate workflow instead.

Estimate ACM and PrivateLink charges separately

ACM ACME charges accrue per domain at issuance and at each renewal, with pricing tiers based on the account's domain issuance volume for the month. ACM API calls have their own account-level monthly pricing rules. Do not treat issuance as the only ACM charge over a certificate's lifecycle.

PrivateLink separately bills each provisioned VPC interface endpoint in each Availability Zone by endpoint-hour; a partial endpoint-hour is billed as a full hour. Processed data is also charged per GB, regardless of traffic source or destination. For example, an enrollment interface endpoint spanning two Availability Zones incurs endpoint-hours in each AZ; add the management endpoint separately if it is also deployed.

Build the estimate from endpoint-hours, processed GB, domain issuance and renewal events, and API usage, then apply current rates for the target Region and the account’s monthly tiers. There is no universal hourly rate or account total here: AZ count, provisioned endpoint duration, and renewal frequency all affect the result.