Vault as an Intermediate CA with AWS Certificate Manager as the Root CA.