Apex domains cannot have CNAME records.
Question and response
Question
dig acm-validations.aws. NS
Answer
acm-validations.aws. 2 NS ns-1123.awsdns-12.org.
acm-validations.aws. 2 NS ns-615.awsdns-12.net.
acm-validations.aws. 2 NS ns-22.awsdns-02.com.
acm-validations.aws. 2 NS ns-1681.awsdns-18.co.uk.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0