Why does Zappa's certificate have to be in us-east-1 and not in the region where I'm running Zappa?
The certificate is for global CloudFront infrastructure, which resides not in a single region but in all regions. us-east-1 is AWS’ “main” region, and is where you need to create most stuff that’s used globally.