Certificate Lifecycle Service  ·  View 01 of 21  ·  Context and scope

System Context

What the platform is asked for, by whom, and the two trust authorities it can never be independent of.

Editable source SVG draw.io All views
What consumes certificates Edge and load balancers CloudFront · ALB Workloads and mesh EKS, 3,800 workloads People Tenant admin Platform SRE Security engineer Trust authorities and custody Public CA ACME, 2 accounts CT logs SCTs, monitoring AWS Private CA root + 2 intermediates Certificate Lifecycle Service issue · renew · verify · revoke Adjacent systems — not owned here Customer DNS registrar of record Secrets platform Deployment pipeline Audit and SIEM adds a domain expiry board sets policy ACME orders SCTs signs leaves public TLS mTLS + bundles delegation delivery readiness events Certificate Lifecycle Service — System Context Application we own Person or role External / third party Security / platform synchronous event / async The relying parties that hold trust bundles are the same edge and workload populations shown above. Out of scope: TLS termination itself, the secrets platform, code signing, and tenant-uploaded certificates (Phase 3). v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • One service spans both trust domains — public-trust certificates for customer custom domains, private-trust identities for workloads — because the inventory and the escalation ladder are what they genuinely share.
  • The public CA is a dependency the platform cannot replace, so it is integrated twice: two accounts, both pre-validated, either able to carry all new issuance within an hour.
  • Customer DNS is drawn as an external system rather than an input, because the platform's authority to issue for a customer's domain is held there and can be withdrawn there.

Out of scope

  • TLS termination itself — the platform supplies certificates to the edge and the mesh, and verifies them, but does not terminate.
  • The secrets platform, used as a delivery channel and not owned here.
  • Code signing, and tenant-uploaded certificates, which are Phase 3 in the requirement.

Assumptions

  • 9,000 tenants, 24,000 customer custom domains, 3,800 internal workloads across 6 clusters in 3 regions, 140 platform-owned public hostnames.
  • Every number in this package is a stated assumption from ask.md, to be replaced by measured telemetry before build.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records01-system-context