So, this works….

aws_profile = pulumi.Config('aws').require('profile')
us_east_1 = Provider('us-east-1', region='us-east-1', profile=aws_profile)

it’s quite unintuitive to need to do that though - especially when the DNS validation of the cert will work fine across accounts