ACM → Certificate Management → Unable to Delete Certificate

I believe, you will need to contact AWS Support directly to resolve this. They have the ability to manually dissociate the stale CloudFront distribution reference from the ACM certificate within their internal systems, allowing you to delete the certificate. Provide them with the ACM certificate ARN and the (now non-existent) CloudFront distribution ID.

I did, and they pointed me here. I'm on a basic package, so I'm stuck.

This type of question has come up a few times in the past, and what has worked for them has been to log a billing support case and provide the all the info you can about the certificate and the (non-existant) CloudFront distribution. As an example see https://repost.aws/questions/QUD6O2O6z2QjelpBx6bcnBaA/cannot-delete-acm-certificate-due-to-uncontrollable-resource-associations

On a basic support plan you can't create technical cases, but should be able to create a billing case.

I have and once again I received an email to post here, as AWS experts do get involved. :(

Here’s why you’re seeing that error and what you can do:

ACM “InUseBy” is sticky When you associate an ACM cert with a CloudFront distribution, ACM records that distribution’s ARN in its InUseBy list. Even if you delete the distribution, ACM doesn’t automatically scrub that reference—so it still thinks the cert is in-use.

There is no public “dissociate” API AWS doesn’t expose a CLI call like acm disassociate-certificate. The only way to clear a stale InUseBy entry is to have a CloudFront distribution update its config to remove the certificate (or to have AWS Support remove it).

Your options

1. Re-associate then remove
2. Recreate (or re-import) some CloudFront distribution that uses your certificate.
3. Update that distribution’s config so it no longer references the ACM cert (i.e. switch it to a different cert or to the default CloudFront cert).
4. Wait ~30 mins for ACM to see the change, then delete your original cert.
5. Open an AWS Support case Ask Support to clear the “ghost” association from ACM’s metadata so you can delete the certificate immediately. They have an internal tool to remove stale InUseBy entries.

Recommended path Since the original distribution truly no longer exists, the fastest way is to file a Support case. In your request include:

1. The certificate ARN.
2. The non-existent distribution ARN that ACM claims is still associated.
3. A note that you’ve verified aws cloudfront get-distribution returns NoSuchDistribution.

Support will confirm and then manually purge the stale reference—after that you can run:

aws acm delete-certificate \
  --certificate-arn arn:aws:acm:us-east-1:…:certificate/… \

Prevent this in future Whenever you delete a CloudFront distribution, first update its config (via CLI or console) to use a different certificate or the default CloudFront cert, wait for the change to propagate, then delete the distribution. That ensures ACM’s InUseBy list stays clean.