AWS can't specify route 53 record without subdomain for cloudfront CNAME

Question

I decided to host my self portfolio on AWS so I done following steps.

1. Host it on s3 (everything OK)
2. Buyed domain in route53
3. Created A type record to point my domain to s3 (everything OK)
4. Generated public certificate in ACM for domains: *.mywebsite.com, mywebsite.com
5. Created CloudFront distribution and with following setiings
   • ORIGIN DOMAIN NAME: links to s3 (everything OK)
   • CNAMES: www.mywebsite.com, *.mywebsite.com, mywebsite.com
   • WIEVER PROTOCOL POLICY: redirect HTTP to HTTPS
   • used custom certificate made in step 4
6. Created another CNAME record that points *.mywebsite.com to cloudfront url

and as I am totally happy about how things works when i go on website with subdomain like:

• www.mywebsite.com
• foobarbaz.mywebsite.com
• http://www.mywebsite.com

All of those work great redirect it to my website throught https protocol but the issue is when I try to reach my website without subdomain like that mywebsite.com thats go through http protocol and for https I end up with ERR_CONNECTION_TIMED_OUT, so I tried adding another CNAME record for name mywebsite.com and got an following error:

Error occurred Bad request. (InvalidChangeBatch 400: RRSet of type CNAME with DNS name mywebsite.com. is not permitted at apex in zone mywebsite.com.)

Any ideas how to get around that issue?

I am not really into networking and configuring those type of stuff, so I would appreciate any tips if I done something wrong.

@edit: tried adding A type record with name mywebsite.com to www.mywebsite.com and received:

(InvalidChangeBatch 400: Tried to create resource record set [name='mywebsite.com.', type='A'] but it already exists), there is already one linking to S3

Answer 1

You have a problem in Step 3). The apex domain points to the S3 bucket, which should point to the CloudFront distribution.

Here's how it should look like:

Route53: ACM certificate CNAME, A record => cloudfront CloudFront: ACM certificate + alias for mywebsite.com, Origin: S3 bucket S3 bucket: host the files

Note that only A records (and AAAA, if you want IPv6) point to CloudFront, and there is only 1 CNAME record that is used by ACM to validate the domain.