You can use AWS Certificate Manager to generate a free auto-renewing certificate and associate that with your CloudFront distribution.

Will simplify your stack a little by removing the LE step