Skip to main content

AWS Cloudfront Distribution Alias Records Without S3 Origin

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of an AWS CloudFront distribution alias record having no S3 origin, you can follow the step-by-step instructions below using the AWS Management Console:

  1. Sign in to the AWS Management Console.
  2. Open the Route 53 console.
  3. In the navigation pane, choose "Hosted zones."
  4. Select the hosted zone for the domain associated with the CloudFront distribution.
  5. Locate the alias record that points to the CloudFront distribution.
  6. Note down the CloudFront distribution domain name associated with the alias record.
  7. Open the CloudFront console.
  8. In the CloudFront console, select the CloudFront distribution with the noted domain name.
  9. Choose the "Origins and Origin Groups" tab.
  10. Click on "Create Origin" or select an existing S3 origin.
  11. Configure the S3 origin by providing the S3 bucket's domain name or its website endpoint.
  12. Save the changes and wait for the CloudFront distribution to deploy the changes.
  13. Once the CloudFront distribution has finished deploying, go back to the Route 53 console.
  14. Select the hosted zone for the domain associated with the CloudFront distribution.
  15. Locate the alias record that points to the CloudFront distribution.
  16. Edit the alias record and update the CloudFront distribution domain name to the correct one.
  17. Save the changes.

By following these steps, you will have successfully remediated the issue of an AWS CloudFront distribution alias record having no S3 origin.

Using CLI

To remediate the misconfiguration of an AWS CloudFront distribution alias record having no S3 origin, you can follow the steps below using the AWS CLI:

Step 1: Identify the CloudFront distribution ID: Run the following command to list all the CloudFront distributions in your AWS account:

aws cloudfront list-distributions

Identify the distribution ID of the misconfigured CloudFront distribution.

Step 2: Update the CloudFront distribution: Run the following command to update the CloudFront distribution with the correct S3 origin:

aws cloudfront update-distribution --id <distribution-id> --origin S3DomainName=<s3-bucket-name>.s3.amazonaws.com

Replace <distribution-id> with the actual distribution ID and <s3-bucket-name> with the name of your S3 bucket.

Step 3: Wait for the distribution update to complete: Run the following command to wait until the distribution update is complete:

aws cloudfront wait distribution-deployed --id <distribution-id>

Replace <distribution-id> with the actual distribution ID.

Step 4: Verify the distribution update: Run the following command to verify that the CloudFront distribution has been updated successfully:

aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.Origins.Items[].DomainName'

Replace <distribution-id> with the actual distribution ID.

This command will return the domain name of the S3 bucket, indicating that the S3 origin has been added successfully.

Step 5: Update Route53 Alias record: Now that the CloudFront distribution has been updated with the correct S3 origin, you need to update the Route53 Alias record to point to the updated CloudFront distribution.

You can update the Route53 Alias record using the AWS Management Console or the AWS CLI. If you prefer using the CLI, you can run the following command:

aws route53 change-resource-record-sets --hosted-zone-id <hosted-zone-id> --change-batch '{"Changes": [{"Action": "UPSERT","ResourceRecordSet": {"Name": "<alias-record-name>","Type": "A","AliasTarget": {"DNSName": "<cloudfront-domain-name>","EvaluateTargetHealth": false},"SetIdentifier": "<identifier>","Weight": 1}}]}'

Replace <hosted-zone-id> with the ID of your Route53 hosted zone, <alias-record-name> with the name of your Alias record, <cloudfront-domain-name> with the CloudFront domain name associated with the distribution, and <identifier> with a unique identifier for the record set.

Step 6: Verify the Route53 Alias record update: Run the following command to verify that the Route53 Alias record has been updated successfully:

aws route53 list-resource-record-sets --hosted-zone-id <hosted-zone-id> --query 'ResourceRecordSets[?Name==`<alias-record-name>`].AliasTarget.DNSName'

Replace <hosted-zone-id> with the ID of your Route53 hosted zone and <alias-record-name> with the name of your Alias record.

This command will return the CloudFront domain name, indicating that the Alias record has been updated successfully.

By following these steps, you can remediate the misconfiguration of an AWS CloudFront distribution alias record having no S3 origin using the AWS CLI.

Using Python

To remediate the misconfiguration of an AWS CloudFront distribution alias record with no S3 origin using Python, follow these steps:

  1. Import the necessary AWS SDK libraries:
import boto3
  1. Initialize the AWS Route53 client:
route53_client = boto3.client('route53')
  1. Retrieve the hosted zone ID for the domain:
response = route53_client.list_hosted_zones_by_name(DNSName='example.com')
hosted_zone_id = response['HostedZones'][0]['Id']

Note: Replace 'example.com' with your actual domain name.

  1. Retrieve the existing record sets in the hosted zone:
response = route53_client.list_resource_record_sets(HostedZoneId=hosted_zone_id)
record_sets = response['ResourceRecordSets']
  1. Identify the CloudFront distribution alias record without an S3 origin:
record_to_update = None
for record_set in record_sets:
    if record_set['Type'] == 'A' and record_set['AliasTarget']['DNSName'].startswith('d123456789.cloudfront.net'):
        if 'S3OriginConfig' not in record_set['AliasTarget']:
            record_to_update = record_set
            break

Note: Replace 'd123456789.cloudfront.net' with the CloudFront distribution DNS name.

  1. Update the record set with the correct S3 origin:
if record_to_update:
    route53_client.change_resource_record_sets(
        HostedZoneId=hosted_zone_id,
        ChangeBatch={
            'Changes': [{
                'Action': 'UPSERT',
                'ResourceRecordSet': {
                    'Name': record_to_update['Name'],
                    'Type': record_to_update['Type'],
                    'AliasTarget': {
                        'HostedZoneId': record_to_update['AliasTarget']['HostedZoneId'],
                        'DNSName': record_to_update['AliasTarget']['DNSName'],
                        'EvaluateTargetHealth': record_to_update['AliasTarget']['EvaluateTargetHealth'],
                        'S3OriginConfig': {
                            'OriginAccessIdentity': ''
                        }
                    }
                }
            }]
        }
    )

That's it! The CloudFront distribution alias record without an S3 origin will now be updated with the correct S3 origin configuration.

Using Terraform
resource "aws_route53_record" "OBSOLETE_ALIAS_RECORD" {
  # Setting count = 0 tells Terraform to delete this alias record
  # from Route 53. This mirrors the CLI DELETE change-batch call.
  count = 0

  zone_id = "HOSTED_ZONE_ID"              # e.g. "Z123456789ABCDEFG", from the hosted zone
  name    = "OBSOLETE_RECORD_NAME"        # e.g. "app.example.com."
  type    = "A"                           # or "AAAA" to match the existing record

  alias {
    name                   = "ALIAS_TARGET_DNS_NAME"        # e.g. "d123.cloudfront.net."
    zone_id                = "ALIAS_TARGET_HOSTED_ZONE_ID"  # e.g. CloudFront hosted zone ID
    evaluate_target_health = false                          # match existing setting
  }
}
  • Substitute:
    • HOSTED_ZONE_ID with the hosted zone ID of the current record.
    • OBSOLETE_RECORD_NAME with the exact DNS name of the obsolete alias record.
    • ALIAS_TARGET_DNS_NAME and ALIAS_TARGET_HOSTED_ZONE_ID with the current alias target values from the existing record.

This is a destructive remediation: applying it will permanently delete the DNS record and can cause an outage if the record is still in use. Only do this after manually verifying the record is obsolete.

Updating the CloudFront distribution’s origins to point to an S3 bucket is a separate change on aws_cloudfront_distribution and must be done there; it cannot be remediated from the Route 53 resource.

Verification:
terraform plan should show a - destroy action for the existing aws_route53_record.OBSOLETE_ALIAS_RECORD[0] instance (or equivalent), with no new replacement record created.