Back to notes
• 3 min read

Route 53 Alias Record with CloudFormation

CloudFront is serving your site, but only at a generated d1234.cloudfront.net URL. Visitors need to reach it at your actual domain. A Route 53 alias record connects the two.

The Record

The AWS::Route53::RecordSet resource creates an A-record alias that points your domain to the CloudFront distribution.

  DomainRecord:
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref DomainName
      Type: A
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2

HostedZoneId: !Ref HostedZoneId is the hosted zone for your domain. This is the same parameter you passed into the cert stack in post 3. Add it as a parameter to this stack if it’s not there already.

Name: !Ref DomainName is the domain name for the record. This matches the Aliases value on your CloudFront distribution from post 7.

Type: A creates an IPv4 address record. With an alias target, Route 53 resolves it to the CloudFront distribution’s IP addresses automatically. No hardcoded IPs.

DNSName: !GetAtt CloudFrontDistribution.DomainName is the CloudFront distribution’s generated domain name (the d1234.cloudfront.net URL). Route 53 routes traffic to this endpoint.

HostedZoneId: Z2FDTNDATAQYW2 is the hosted zone ID for CloudFront itself. This is a fixed AWS constant, the same for every CloudFront distribution in every account and region. It tells Route 53 that the alias target is a CloudFront distribution. You do not change this value.

IPv6 Record

CloudFront has IPv6 enabled by default. Without an AAAA record, IPv6 clients cannot resolve the domain to a CloudFront edge. The resource is identical to the A record except for the Type.

  DomainRecordAAAA:
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref DomainName
      Type: AAAA
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2

Type: AAAA creates an IPv6 address record. Same alias target, same hosted zone ID. Route 53 resolves it to CloudFront’s IPv6 addresses.

Why an Alias

A standard CNAME record would also point a domain to CloudFront, but it has two problems. First, DNS rules prohibit CNAME records on the zone apex (example.net), so it only works for subdomains. Second, Route 53 charges for CNAME queries. Alias records work at the apex, resolve within the AWS network, and Route 53 does not charge for alias queries to AWS resources.

Updating the Role

Your Git Sync role from post 4 needs Route 53 permissions so CloudFormation can create the record. Add this statement to the inline policy in your role stack.

              - Effect: Allow
                Action:
                  - 'route53:ChangeResourceRecordSets'
                  - 'route53:GetHostedZone'
                  - 'route53:GetChange'
                  - 'route53:ListResourceRecordSets'
                Resource: '*'

The role already has route53:ChangeResourceRecordSets, route53:GetHostedZone, and route53:GetChange from post 4 (for DNS validation). route53:ListResourceRecordSets is the new addition. CloudFormation uses it to check existing records before creating or updating the alias.