[phinnaeus]

That's not quite right. You must provision your CloudFront certificate in us-east-1 because that's where CloudFront is. You can provision ACM certs in any region.