I recently received a notification from AWS indicating that ACM certificates I had in place for some S3 buckets I expose for websites could not renew due to an inability to validate via DNS.

Figuring out how to make it work was non-trivial, so I'm writing it up so I can remember in the future, and maybe save somebody else some trouble, as everything I found had to do with auto-provisioning via Terraform.