i wonder why pulumi would create all my resources in the correct account but not this particular certificate… it looks like it has been issued and validated but the cert is in my top level AWS account while all other resources are in aws org child account

Depending how its set up, check your access keys. Prolly pointed to incorrect account. If not, did you create a new aws provider and supply the customopts for provider?

I did create a new provider, i am thinking that may be it