It's complicated a one-fits-all solution. We ended using the S3 as storage back-end to provision, also to get a single cert for all frontend instances.