Allow Aws Certificate Manager to optionally create certificates in us-east-1

[gkoreman]

CloudFront/IAM/S3 deploy to us-east-1 despite the region you target. We would like to allow SAM's ACM to optionally deploy to us-east-1 as well. People are working around this with custom functions (https://github.com/dflook/cloudformation-dns-certificate) but it feels like a great candidate for a feature!

My use case is this: I would like to deploy my frontend (static website) and backend (appsync/dynamodb/etc) both with the same SAM template. My backend gets deployed to us-west-2 and the frontend gets deployed to us-east-1 in an S3 bucket with a cloudfront distribution.

[hoffa]

To understand the idea better, what is the problem that deploying the certificate to us-east-1 solves?

[gkoreman]

Cloudfront requires a certificate deployed to us-east-1.

[gkoreman]

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html

[wbattou]

I add another use case:
Deploy an API Gateway with a custom domain and an EDGE endpoint with SAM. If we want to deploy that in another region than us-east-1 we need to build a custom resource.