Search code examples
amazon-cloudfrontamazon-route53

CloudFront to a public or private Route53 hosted zone


I have an ALB created with Terraform and a CloudFront Distribution which is so old that it's not managed by Terraform. My ALB was given a random number in the DNS name and I have concerns about entering this ALB DNS as Origin in CloudFront.

So my idea was, to setup a Route53 entry that would be more or less fixed and also managed via Terraform. But I haven't found a way so far that CloudFront will point to my Route53 hosted zone. Therefore I ask if a registered domain is necessary.

Is it possible that a CloudFront Origin points to a Route53 entry without a domain being registered, i.e. only to private or public hosted zone entries?


Solution

  • You seem to be concerned about the longevity of the DNS name of your ALB. The DNS name of your ALB is static as long as your ALB exists. If you delete it, you'll get a new one, but as long as it stays, it will be static.

    So if you don't plan to periodically delete your ALB, I'd be perfectly comfortable using it's DNS name as the origin in CloudFront.


    About your DNS questions:

    You can also add an ALIAS or CNAME record in a public hosted zone that points to your ALB (or it's DNS name in case of CNAME), which is managed by Terraform. It has to be a public hosted zone with a real domain, i.e. some zone must be delegated through DNS to Route53. Remember that you'll have to create a SSL/TLS certificate for this to work. Afterwards you could set up the custom domain name as the origin in CloudFront. This requires you to have a (sub-)domain that is delegated to your public hosted zone.

    You can't do the same with a private hosted zone though. CloudFront needs a DNS name it can resolve and since CloudFront is not part of your VPC, it needs a publicly resolvable DNS name, which the private hosted zone doesn't provide.