When ACM certificate is modified, pulumi up hangs on trying to delete the old cert, that is in use by api gateway. Looks like bug to me, as it should first update certificate ARN in API GW custom domain and then delete old one once it appears not in use