AWS CERTIFICATE MANAGER HAS ANNOUNCED EXPORTABLE TLS CERTIFICATES, AND I'M MOSTLY OKAY WITH IT

Summary from the TLDR InfoSec newsletter

Recently, AWS Certificate Manager (ACM) added the ability to export certificates and private keys for use in EC2 or external applications. Currently, ACM does not implement ACME, so certificate renewals must be handled manually or via the AWS API. Organizations that want to ensure that private keys never leave ACM can disable exports at the AWS Organization level or on an account-by-account basis via SCPs.