Amazon CloudFront
Developer Guide (API Version 2014-10-21)
Did this page help you?  Yes | No |  Tell us about it...
« PreviousNext »
View the PDF for this guide.Go to the AWS Discussion Forum for this product.Go to the Kindle Store to download this guide in Kindle format.

Using Alternate Domain Names (CNAMEs)

In CloudFront, an alternate domain name, also known as a CNAME, lets you use your own domain name (for example, www.example.com) for links to your objects instead of using the domain name that CloudFront assigns to your distribution. Both web and RTMP distributions support alternate domain names.

When you create a distribution, CloudFront returns a domain name for the distribution, for example:

d111111abcdef8.cloudfront.net

When you use the CloudFront domain name for your objects, the URL for an object called /images/image.jpg is:

http://d111111abcdef8.cloudfront.net/images/image.jpg

If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name that CloudFront assigned to your distribution, you can add an alternate domain name to your distribution for www.example.com. You can then use the following URL for /images/image.jpg:

http://www.example.com/images/image.jpg

Using the * Wildcard in Alternate Domain Names

When you add alternate domain names, you can use the * wildcard at the beginning of a domain name instead of specifying subdomains individually. For example, with an alternate domain name of *.example.com, you can use any domain name that ends with example.com in your object URLs, such as www.example.com, product-name.example.com, and marketing.product-name.example.com. The name of an object is the same regardless of the domain name, for example:

www.example.com/images/image.jpg

product-name.example.com/images/image.jpg

marketing.product-name.example.com/images/image.jpg

The alternate domain name must begin with an asterisk and a dot ( *. ). You cannot use a wildcard to replace part of a subdomain name, like this: *domain.example.com, and you cannot replace a subdomain in the middle of a domain name, like this: subdomain.*.example.com.

A wildcard alternate domain name can overlap with another alternate domain name as long as they're both in the same CloudFront distribution. For example, you can use both www.example.com and *.example.com as alternate domain names, but they must be in the same distribution.

Restrictions on Using Alternate Domain Names

Note the following restrictions on using alternate domain names:

  • For the current limit on the number of alternate domain names that you can add to a distribution, see Amazon CloudFront Limits in the Amazon Web Services General Reference. To request a higher limit, go to https://console.aws.amazon.com/support/home#/case/create?issueType=service-limit-increase&limitType=service-code-cloudfront-distributions.

  • You must have permission to create a CNAME record with the DNS service provider for the domain. Typically, this means that you own the domain, but you may also be developing an application for the domain owner.

  • You cannot add an alternate domain name to a CloudFront distribution if the alternate domain name already exists in another CloudFront distribution, even if your AWS account owns the other distribution.

  • The DNS protocol does not allow you to create a CNAME record for the top node of a DNS namespace, also known as the zone apex. For example, if you register the DNS name example.com, the zone apex is example.com. You cannot create a CNAME record for example.com, but you can create CNAME records for www.example.com, newproduct.example.com, and so on.

    If you're using Amazon Route 53 as your DNS service, you can create an alias resource record set instead of a CNAME. With an alias resource record set, you don't pay for Amazon Route 53 queries. In addition, you can create an alias resource record set for a domain name at the zone apex (example.com). For more information, go to Routing Queries to an Amazon CloudFront Distribution in the Amazon Route 53 Developer Guide.

  • If you want viewers to use HTTPS with an alternate domain names, additional configuration is required. For more information, see Using Alternate Domain Names and HTTPS.

Adding an Alternate Domain Name

The following task list describes the process for using the CloudFront console to add an alternate domain name to your distribution so you can use your own domain name in your links instead of the CloudFront domain name that is associated with your distribution.

Note

If you want viewers to use HTTPS with your alternate domain name, see Using Alternate Domain Names and HTTPS.

For information about updating your distribution using the CloudFront API, see Working with Distributions.

Process for Adding an Alternate Domain Name Using the CloudFront Console

  1. Sign in to the AWS Management Console and open the CloudFront console at https://console.aws.amazon.com/cloudfront/.

  2. In the CloudFront console, use the steps below to update your distribution to include your domain name as an alternate domain name in the Alternate Domain Names (CNAMEs) field.

    1. In the top pane of the CloudFront console, select the distribution that you want to update, and click Distribution Settings.

    2. On the General tab, click Edit.

    3. Add the applicable alternate domain names in the Alternate Domain Names (CNAMEs) field. Separate domain names with commas or put each one on a new line.

    4. Web distributions only: For SSL Certificate, choose the applicable option:

      • If you don't want to use SSL: Click Default CloudFront Certificate.

      • If you do want to use SSL: Click Custom SSL Certificate Stored in IAM, and select a certificate from the list.

        If the desired certificate doesn't appear in the list, review the procedure To use alternate domain names with HTTPS to confirm that you correctly uploaded the certificate to the IAM certificate store.

        If you choose this setting, we recommend that you use only an alternate domain name in your object URLs (https://example.com/logo.jpg). If you use your CloudFront distribution domain name (https://d111111abcdef8.cloudfront.net/logo.jpg) and the viewer supports SNI, then CloudFront behaves normally. However, a viewer that does not support SNI exhibits one of the following behaviors, depending on the value of Clients Supported:

        • All Clients: If the viewer doesn't support SNI, it displays a warning because the CloudFront domain name doesn't match the domain name in your SSL certificate.

        • Only Clients that Support Server Name Indication (SNI): CloudFront drops the connection with the viewer without returning the object.

    5. Web distributions only: Choose the applicable option for Clients Supported:

      • All Clients: CloudFront serves your HTTPS content using dedicated IP addresses. If you select this option, you incur additional charges when you associate your SSL certificate with a distribution that is enabled. For more information, see http://aws.amazon.com/cloudfront/pricing.

      • Only Clients that Support Server Name Indication (SNI): Older browsers or other clients that don't support SNI must use another method to access your content.

      For more information, see Choosing How CloudFront Serves HTTPS Requests.

    6. Click Yes, Edit.

  3. In the CloudFront console, on the General tab for your distribution, confirm that the status of your distribution has changed to Deployed. If you try to use an alternate domain name before the updates to your distribution have been deployed, the links you create in the following steps might not work.

  4. Using the method provided by your DNS service provider, add a CNAME resource record set to the hosted zone for your domain. This new CNAME resource record set will redirect DNS queries from your domain (for example, www.example.com) to the CloudFront domain name for your distribution (for example, d111111abcdef8.cloudfront.net). For more information, see the documentation provided by your DNS service provider.

    If you're using Amazon Route 53 as your DNS service, you can create an alias resource record set instead of a CNAME. With an alias resource record set, you don't pay for Amazon Route 53 queries. In addition, you can create an alias resource record set for a domain name at the zone apex (example.com), which DNS doesn't allow for CNAMEs. For more information, go to Routing Queries to an Amazon CloudFront Distribution in the Amazon Route 53 Developer Guide.

    Important

    If you already have an existing CNAME record for your domain name, update that resource record set or replace it with a new one that points to the CloudFront domain name for your distribution.

    In addition, confirm that your CNAME resource record set points to your distribution's domain name and not to one of your origin servers.

  5. Using dig or a similar tool, confirm that the CNAME resource record set that you created in Step 4 points to the domain name for your distribution. For more information about dig, go to http://www.kloth.net/services/dig.php.

    The following example shows a dig request on the images.example.com domain, as well as the relevant part of the response.

    [prompt]> dig images.example.com
    									
    ; <<> DiG 9.3.3rc2 <<> images.example.com
    ;; global options:  printcmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15917
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 2, ADDITIONAL: 0
    
    ;; QUESTION SECTION:
    ;images.example.com.     IN    A
    									
    ;; ANSWER SECTION:
    images.example.com. 10800 IN  CNAME  d111111abcdef8.cloudfront.net.
    ...
    ...

    The line in the Answer Section shows a CNAME resource record set that routes queries for images.example.com to the CloudFront distribution domain name d111111abcdef8.cloudfront.net. The CNAME resource record set is configured correctly if the name on the right side of CNAME is the domain name for your CloudFront distribution. If that is any other value, for example, the domain name for your Amazon S3 bucket, then the CNAME resource record set is configured incorrectly. In that case, go back to Step 4 and correct the CNAME record to point to the domain name for your distribution.

  6. Test the alternate domain name by creating some test links that use your domain name in the URL instead of the CloudFront domain name for your distribution.

  7. In your application, change the links for your objects to use your alternate domain name instead of the domain name of your CloudFront distribution.