AWS › AWS Certificate Manager (ACM)

How does using a certificate with a CloudFront distribution differ in terms of region requirements compared to other services?

Intermediate

Answer

ACM certificates used with CloudFront must specifically be requested in the US East, North Virginia, region regardless of where your users or other resources are located, since CloudFront is a global service that centrally manages certificates from that specific region, while certificates used with a regional service like an Application Load Balancer must instead be requested in the same region as that load balancer.

aws acm request-certificate --domain-name example.com --validation-method DNS --region us-east-1

Real-world example A company managing a CloudFront distribution mistakenly requests a certificate in a different region and discovers it cannot be attached to CloudFront, later correcting the mistake by requesting a new certificate specifically in US East North Virginia.

Common follow-ups: Why does CloudFront require certificates specifically from the US East North Virginia region?;Does this same regional restriction apply to Application Load Balancer certificates?

Amazon CloudFront & Content Delivery;AWS Global Infrastructure (Regions AZs & Edge Locations)