Is Cloudfront works only in Virginia region (us-east-1)

Cloud front is a global CDN but it is managed from the global region of us-east-1.

In order to have a certificate assigned to cloudfront, then you will need to create one in acm also in the same region us-east-1

The same applies to managing waf for cf. it’s in the global region.

It’s similar for IAM. Its global region is the same.

If this helps please be sure to accept the answer to help others and me.

Yes CloudFront is global but it considers us-east-1 as global region. The ACM certificates must be imported from here and the same is distributed across all geographic regions. https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html