Certificates obtained through Amazon Certificate Manager (ACM) can only be installed on Elastic Load Balancers, CloudFront, API Gateway, and other AWS services. They cannot be exported or installed directly onto EC2 instances.
If you want to install an SSL certificate directly on your EC2 instance, you cannot use ACM. Instead, you will need to obtain an SSL certificate through a third-party (such as Lets Encrypt, GoDaddy, ec.) and install it following the instructions for your web server.
It is 100% valid to put an ELB in front of a single EC2 instance, especially for the purpose of letting the ELB manage the SSL certificate.
Other benefits of using ELB in front of your EC2 instance:
- You'll gain the protection of AWS Shield (which provides some levels of DDoS protection),
- You can replace the EC2 instance or scale out more easily if needed in the future,
- The ELB will handle the encryption/decryption of the HTTPS connections (freeing your EC2 instance's CPU to do other work)