CloudFront - Origin Domain field is automatically filling S3 static website URL

When creating the CloudFront distribution, you need to change Origin Access to Origin access control settings (recommended)

You will need to create a new OAC and update S3 bucket policy. Refer to blog Amazon CloudFront introduces Origin Access Control (OAC) for steps involved.

It takes a while for a CloudFront distribution to be created. Once CloudFront distribution status is Enabled, then go to Route 53 to create your Alias record. You should find your distribution (ID.cloudfront.net) in the dropdown.

You will need to create a CNAME with your CloudFront distribution, and associate ACM cert, in order to use your domain

Bucket configuration changes follow an eventual consistency model. If you had static website hosting enabled for your bucket and then disabled it, the change won't take effect instantly. It may take a variable amount of time for the feature actually to be disabled and for the new configuration to be reflected in other contexts, such as in the CloudFront configuration views in the console. If this is the issue, it'll resolve itself, probably within 15-30 minutes of disabling the static website hosting option.

Thank you for providing details about your setup. Let's address the issues you're facing:

1. Regarding the Origin Domain field automatically changing to the S3 static website URL: This behavior is unexpected, especially since you've disabled static website hosting on your S3 bucket. Typically, when using CloudFront with a private S3 bucket (not configured as a static website), you should be able to select the S3 bucket's REST API endpoint.

   To resolve this, try the following:

   • Ensure that your S3 bucket is indeed not configured for static website hosting.
   • When creating the CloudFront distribution, manually enter the S3 bucket's REST API endpoint (e.g., my-bucket-name.s3.amazonaws.com) instead of selecting it from the dropdown.
   • If the issue persists, consider using the new S3BucketOrigin class with Origin Access Control (OAC) if you're using AWS CDK, or set up OAC manually in the AWS Console.

2. Regarding the Route 53 A Alias record issue: The greyed-out Virginia region and the message you're seeing are normal. CloudFront distributions are global resources, so they appear in the US East (N. Virginia) region by default.

   If you can't find your CloudFront distribution when trying to create the alias record, check the following:

   • Ensure that the CloudFront distribution has been fully deployed (this can take up to 15-20 minutes).
   • Verify that you're in the correct AWS account and region where the CloudFront distribution was created.
   • Try refreshing the CloudFront distribution list in the Route 53 console.

If these steps don't resolve your issues, you may need to review your overall configuration to ensure all components are correctly set up and integrated. Remember to use Origin Access Control (OAC) for enhanced security when connecting CloudFront to your private S3 bucket.
Sources
Community | Hosting my Static Website in an AWS S3 Bucket + CloudFront— Part 2
S3OriginConfig - Amazon CloudFront
Use your domain for a static website in an Amazon S3 bucket - Amazon Route 53
A new AWS CDK L2 construct for Amazon CloudFront Origin Access Control (OAC) | AWS DevOps & Developer Productivity Blog