Custom Domains and SSL: Mapping Your App with ACM and Route 53

Previously in this course, we explored configuring CloudFront for security by setting up Origin Access Control (OAC) and enforcing HTTPS. Now that your frontend is served securely, the final step in professionalizing your deployment is replacing the default CloudFront URL (e.g., d123.cloudfront.net) with a custom, branded domain name.

In this lesson, we will map a professional domain to your distribution, provision a free managed SSL certificate, and wire up the DNS records required to make it live.

The Foundation: DNS and SSL/TLS

Before jumping into the console, it’s important to understand the two pillars of this process:

1. ACM (AWS Certificate Manager): AWS provides free, public SSL/TLS certificates for your AWS resources. Because CloudFront is a global service, you must request your certificate in the us-east-1 (N. Virginia) region, even if your other resources are elsewhere.
2. Route 53: This is your DNS service. To point your domain (e.g., myapp.com) to CloudFront, you create an "Alias" record. Unlike a standard CNAME, an Alias record is an AWS-specific construct that lets you map your naked domain (the root) directly to the CloudFront distribution address.

Step 1: Requesting an SSL Certificate in ACM

1. Navigate to the Certificate Manager console in AWS.
2. Ensure your region is set to US East (N. Virginia).
3. Click Request a certificate > Request a public certificate.
4. Enter your domain name (e.g., example.com and *.example.com for subdomains).
5. Select DNS validation. AWS will provide a CNAME record that you must add to your DNS provider to prove you own the domain.
6. Once you create that record in Route 53 (see below), the certificate status will change from "Pending validation" to "Issued."

Step 2: Configuring Route 53 DNS Records

If you registered your domain through Route 53, this is straightforward. If you used a third-party registrar (like Namecheap or GoDaddy), you need to update your domain's nameservers to point to the four values provided by your Route 53 Hosted Zone.

To map your domain to CloudFront:

1. Go to Route 53 > Hosted Zones and select your domain.
2. Click Create record.
3. Leave the Record name empty (for the root domain) or enter www.
4. Toggle the Alias switch to ON.
5. Choose Alias to CloudFront distribution as the endpoint.
6. Select your distribution from the list.

Step 3: Updating CloudFront

CloudFront needs to know that it is now responsible for your custom domain.

1. Open your CloudFront distribution settings.
2. Under General > Settings, find Alternate domain names (CNAMEs).
3. Add your domain name (e.g., myapp.com).
4. Under Custom SSL certificate, select the certificate you issued in Step 1.
5. Save your changes. It may take several minutes for the distribution to deploy the update across the global edge network.

Hands-on Exercise

Your task is to configure the domain mapping for your project:

• Request a certificate in us-east-1 for your domain.
• Add the CNAME record provided by ACM to your Route 53 Hosted Zone.
• Update your CloudFront distribution’s "Alternate Domain Names" and attach the new certificate.
• Verify the connection by browsing to https://yourdomain.com.

Common Pitfalls

• Region Mismatch: Forgetting to request the certificate in us-east-1 is the #1 cause of frustration. CloudFront will not show your certificate in the dropdown menu if it was created in any other region.
• DNS Propagation: DNS changes are not instantaneous. If you update your records and the site doesn't load immediately, wait 5–10 minutes. Use dig or nslookup in your terminal to verify that your records have propagated.
• Missing CNAME: If you don't add the domain to the CloudFront "Alternate domain names" list, CloudFront will reject the request because it doesn't recognize the incoming Host header.

FAQ

Q: Can I use a third-party certificate? A: Yes, but you would have to manage renewals yourself. ACM provides automated renewal, which is a massive operational advantage.

Q: Why does the root domain need an Alias record? A: DNS specifications do not allow CNAME records at the "apex" (root) of a domain. Route 53 Alias records bypass this limitation by resolving the record internally to the IP address of your CloudFront distribution.

Q: How do I handle HTTP to HTTPS redirection? A: CloudFront handles this automatically if you configured it as we did in Configuring CloudFront for Security.

Recap

Mapping a custom domain involves three distinct AWS services working in tandem: ACM secures the traffic with SSL, Route 53 directs the traffic via DNS, and CloudFront acts as the global host. By utilizing Alias records and ACM-managed certificates, you ensure your project is both secure and professional.

Up next: Project Integration: Frontend to Backend, where we will finally connect your browser-based code to the API Gateway endpoints we built earlier.