Northwind Insurance operates a central security account with an ACM Private CA. Application teams in multiple AWS accounts must request and renew private TLS certificates using ACM in their own accounts and attach them to ALBs, with no manual CSR handling. Which TWO actions should the security team take to enable this? (Choose two.)

To allow application accounts to request certificates from a central ACM Private CA, the CA must first be shared with those accounts. AWS Resource Access Manager (RAM) is the service designed for sharing AWS resources, including ACM Private CAs, across accounts within an organization. After sharing, a resource policy must be attached to the Private CA. This policy grants the ACM service principal (acm.amazonaws.com) in the specified application accounts (SourceAccount) permission to issue certificates (acm:IssueCertificate). This combination enables application teams to request private certificates directly through ACM in their own accounts, which are then signed by the shared Private CA. Incorrect options: Route 53 DNS validation is for public certificates or private certificates where the domain is publicly resolvable and owned by the account requesting the certificate. For private CAs, ACM uses the CA for validation. Exporting and importing the CA certificate chain doesn't enable certificate issuance; it only provides the trust anchor. SCPs control maximum permissions but don't grant them. They cannot enable cross-account resource access or certificate issuance from a private CA.