How to disassociate CloudFront distribution from alias sub-domain?

Question

We have the following scenario:

1. We are using S3 and CloudFront.
2. An engineer has created an `S3` bucket and `CloudFront Distribution` under their personal account. 
3. They then associated the CloudFront to a sub-domain owned by the company.
4. The company owns the domain.
5. They left the company.

This is obviously an unacceptable practice and is probably one of the reasons the engineer is no longer working for the company. Unfortunately, we now have to sort it out.

Now to the issue at hand.

We've created a new S3 bucket and `CloudFront` distribution. But as you'd expect, we are unable to associate the new distribution ID with the same sub-domain and are getting the following error:

```
CNAMEAlreadyExists: One of more of the CNAMEs you provided are already associated with a different resource
```

We have already tracked down the conflicting CF distribution id:

```
$ aws-vault exec corp-dev -- aws cloudfront list-conflicting-aliases --alias dev.local.domain --distribution-id XYZ
{
    "ConflictingAliasesList": {
        "MaxItems": 100,
        "Quantity": 1,
        "Items": [
            {
                "Alias": "dev.local.domain",
                "DistributionId": "******ECHOHUO",
                "AccountId": "******000000"
            }
        ]
    }
}

```

However, it is not entirely clear how to disassociate the subdomain from that distribution ID. The company is owns the domain and Route53.

Do we need to involve AWS support for this or is there a non-obvious way to force the disassociation, so the subdomain(s) can be re-used again?

Accepted Answer

This is definitely a case where engaging the support team is the right answer. Because the resource is owned by another account there's nothing that you can (directly) do here.

Answer

One thing I can think of is that the subdomain definition in the domain's hosted zone is still pointing to the former employee's Route 53, where he set up a hosted zone to control the subdomain. If that is the case, you should create your own hosted zone for that subdomain and then change the NS records for the subdomain in the hosted zone of the domain to NS records define in the subdomain's hosted zone. Then you can add the Aliased A records to the subdomain's hosted zone. Something like this:

Current Company Hosted Zone (company.com): 
```
sub.company.com NS - NS1, NS2, NS3
```
Current Ex-Employee's Hosted Zone:
```
sub.company.com NS - NS1, NS2, NS3
sub.company.com A (alias) - Employee CloudFront Distribution
```
To fix this:

New Company Hosted Zone (sub.company.com)
```
sub.company.com NS - NS4, NS5, NS6
sub.company.com A (alias) - Company CloudFront Distribution
```
Modified Company Hosted zone (company.com)
```
sub.company.com NS - NS4, NS5, NS6
```

How to disassociate CloudFront distribution from alias sub-domain?

Relevant content