There is a wrinkle in ACM certificate validation and renewal that isn't obvious:

• If the domain for your certificate has CAA records for some other certificate provider (e.g., letsencrypt.org), then you will need to add a CAA record to the domain for amazon.com. The value of the CAA record should be 0 issue "amazon.com". You will also need to create the CNAME record in the domain as directed by ACM. If there is no CAA record for amazon.com, the certificate validation or renewal process will fail without any message about why it is failing.
• If there are no CAA records present in the domain for your certificate, then creating CNAME records as directed by ACM will be sufficient for certificate validation and renewal.