CF distro and ACM certificate in different account

Question

Is it possible to create a CF distro in account A using an ACM's issued certificate sitting in account B?

CF doc states it is NOT possible (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-limits.html) but I can see a customer config (in ACM console) where a certificate is listing as associated resources CF distros belonging to a different account

I have tried to do so (via CFN) and I am getting a "The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain" error msg so I am not sure whether it is a poor error messaging (i.e. access denied due to cross-account attempt) or smth else going on

Thanks!

Accepted Answer

ACM does not currently support cross account access. CloudFront distributions checks ACM certs in the account where they belong to. You can use the same certificate for CloudFront distributions that were created by using different AWS accounts if it's a third-party CA certificate (not provided by ACM) imported into ACM (for the account where the distribution belongs to).

CF distro and ACM certificate in different account

Relevant content