A TLS endpoint certificate is nearing expiration. The team wants automated renewal where supported without storing its private key in source control. Which service should it use?

1. AWS Certificate Manager with a supported integrated service and maintained validation requirements.
2. A Route 53 TXT record containing the private key.
3. An IAM password policy to renew the endpoint certificate.
4. A self-signed certificate committed with its private key to the public repository.