AWS Certified Security - Specialty (SCS-C03) Practice Question Bank — PracticeTrial (no sign-up)

Internal services need private X.509 certificates from a centrally governed CA hierarchy, with no public browser trust requirement. Which AWS service should issue and manage the private CA certificates?