def attach_certificate(distribution_id, iam_cert_id, **kwargs):
    """
    Updates the IAM certificate associated with a distribution
    :param distribution_id: The Id of a distribution
    :param iam_cert_id: The Id of an IAM certificate
    :param kwargs:
        account_number: AWS account number
    :return:
    """
    try:
        client = kwargs["client"]
        # Get the existing config
        response = client.get_distribution_config(Id=distribution_id)
        config = response["DistributionConfig"]
        viewer_cert = config["ViewerCertificate"]
        if "IAMCertificateId" not in viewer_cert:
            raise InvalidDistribution(distribution_id)
        if iam_cert_id == viewer_cert["IAMCertificateId"]:
            current_app.logger.warning(
                "distribution {} already assigned to IAM certificate {}, not updated".format(
                    distribution_id, iam_cert_id))
            return
        viewer_cert["IAMCertificateId"] = iam_cert_id
        if "Certificate" in viewer_cert:
            del viewer_cert["Certificate"]
        if "CertificateSource" in viewer_cert:
            del viewer_cert["CertificateSource"]

        client.update_distribution(
            Id=distribution_id,
            DistributionConfig=config,
            IfMatch=response["ETag"])
    except Exception as e:  # noqa
        metrics.send("get_distribution_error", "counter", 1)
        capture_exception()
        raise

    Updates the IAM certificate associated with a distribution
    :param distribution_id: The Id of a distribution
    :param iam_cert_id: The Id of an IAM certificate
    :param kwargs:
        account_number: AWS account number
    :return:
    
lemur/plugins/lemur_aws/cloudfront.py