There is a wrinkle in ACM certificate validation and renewal that isn't obvious:

• If the domain for your certificate has CAA records for some other certificate provider (e.g., letsencrypt.org), then you will need to add a CAA record to the domain for amazon.com. The value of the CAA record should be 0 issue "amazon.com". You will also need to create the CNAME record in the domain as directed by ACM. If there is no CAA record for amazon.com but there is a CAA record for some other domain, the ACM certificate validation or renewal process will fail without any messaging about why it is failing.
• If there are no CAA records present in the domain for your certificate, then creating CNAME records as directed by ACM will be sufficient for certificate validation and renewal.