Why does my ACM cert give associated resources in another account?

Deploying a Regional API endpoint creates an Application Load Balancer by API Gateway. The Application Load Balancer is owned by API Gateway service, not your account. The ACM certificate provided to deploy API Gateway is associated with the Application Load Balancer.

Similarly, defining a custom endpoint for your domain in Amazon ElasticSearch Service (Amazon ES) creates an Application Load Balancer. The Application Load Balancer is owned by the ElasticSearch service, not by your account. The ACM certificate provided with creating the custom endpoint is associated with the Application Load Balancer.

To remove the association of the ACM certificate with the Application Load Balancer given any of these use cases, please follow the guidelines outlined in our blogpost (https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-resources/) for the respective service.