xdr-terraform-live/prod/aws-us-gov/mdr-prod-root-ca/012-subordinate-cas

Subordinate CA

The subordinate CA certificate exists in the common services account, so why is it here?

Two reasons: 1) Because it has to be signed by the root CA, and any such use of the root CA generates alerts and needs to be done cautiously and with great justification. 2) The common services provider profile is already available everywhere