"The parameter origin name must be a domain name" error when trying to use AWS::CloudFront::VpcOrigin

Question

I have these template bits:

```
  RendezvousVpcOrigin:
    Type: AWS::CloudFront::VpcOrigin
    Properties:
      VpcOriginEndpointConfig:
        Name: !Sub "${EnvironmentName}-RendezvousEc2VpcOrigin"
        Arn: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/${RendezvousEc2Instance}"
        HTTPPort: !Ref AppPort
        OriginProtocolPolicy: http-only # The EC2 instance runs an HTTP server
      Tags:
        - Key: Name
          Value: !Sub "${EnvironmentName}-RendezvousVpcOrigin"
```
and

```
  RendezvousCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: RendezvousVpcOrigin # Ensure VPC Origin is deployed before the distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: !Sub "CloudFront distribution for Rendezvous Rust Service (${EnvironmentName})"
        Origins:
          - Id: RendezvousEc2Origin # Logical ID for the origin
            DomainName: !GetAtt RendezvousVpcOrigin.Id # Reference the VPC Origin's ID
            VpcOriginConfig:
              VpcOriginId: !Ref RendezvousVpcOrigin # Reference the VPC Origin resource
              OriginKeepaliveTimeout: 5
              OriginReadTimeout: 30
        DefaultCacheBehavior:
          TargetOriginId: RendezvousEc2Origin
          ViewerProtocolPolicy: redirect-to-https # Enforce HTTPS for viewers
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true # Enable Gzip compression
          ForwardedValues:
            QueryString: true
            Headers:
              - Host
            Cookies:
              Forward: none
        ViewerCertificate:
          CloudFrontDefaultCertificate: true # Use CloudFront's default SSL certificate
        HttpVersion: http2and3 # Support HTTP/2 and HTTP/3
        IPV6Enabled: true # Enable IPv6 for viewer connections
        PriceClass: PriceClass_100 # Use only US, Europe, and Asia for cost optimization
```

My EC2 instance has Private IP and IPv6 on a Public Subnet, but deliberately no Public IPv4.

The Security Group has been set to Allow All Inbound 0.0.0.0/0 for troubleshooting.

When trying to deploy, I get this error:

> Resource handler returned message: "Invalid request provided: AWS::CloudFront::Distribution: The parameter origin name must be a domain name. (Service: CloudFront, Status Code: 400, Request ID: 42d6f8ec-a317-47b2-928c-6fa9ce45af8c) (SDK Attempt Count: 1)" (RequestToken: 91d24680-3519-ddac-b85c-36ff0e27a1b6, HandlerErrorCode: InvalidRequest)

I have tried many different variations and I feel like this is the closest to finally working... What's causing the error?

Riku_Kobayashi · Accepted Answer

Hello.

The "DomainName" of "AWS::CloudFront::Distribution" must be set to the EC2 domain name.  
So, try setting the private DNS name for your EC2 instance as follows:  
Also, please modify the code so that the ID returned by "AWS::CloudFront::VpcOrigin" is obtained using !GetAtt.  
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-domainname  
```
  RendezvousCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: RendezvousVpcOrigin # Ensure VPC Origin is deployed before the distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: !Sub "CloudFront distribution for Rendezvous Rust Service (${EnvironmentName})"
        Origins:
          - Id: RendezvousEc2Origin # Logical ID for the origin
            DomainName: "ip-172-31-x-x.ap-northeast-1.compute.internal" # Edit
            VpcOriginConfig:
              VpcOriginId: !GetAtt RendezvousVpcOrigin.Id #Edit
              OriginKeepaliveTimeout: 5
              OriginReadTimeout: 30
.....

```

re:Post Agent · Answer

The error "The parameter origin name must be a domain name" occurs because you're not using the correct property for the VPC Origin integration in your CloudFront distribution.

When using AWS::CloudFront::VpcOrigin with a CloudFront distribution, you need to reference it properly in the Origins section. The issue is with how you're setting up the DomainName property in your CloudFront distribution's origin configuration.

The DomainName property requires a valid domain name, but you're trying to use `!GetAtt RendezvousVpcOrigin.Id` which doesn't return a domain name. For VPC origins, you don't need to specify a DomainName at all when using VpcOriginConfig.

Here's how you should modify your CloudFront distribution's origin configuration:

```yaml
Origins:
- Id: RendezvousEc2Origin
VpcOriginConfig:
VpcOriginId: !Ref RendezvousVpcOrigin
OriginKeepaliveTimeout: 5
OriginReadTimeout: 30
```

Remove the DomainName property entirely when using VpcOriginConfig. The VpcOriginId property is sufficient to establish the connection between your CloudFront distribution and the VPC origin.

Also, make sure your EC2 instance has a publicly resolvable DNS name that routes requests from clients to targets over the internet, as this is required for CloudFront origins. Since you mentioned your EC2 instance is in a public subnet but deliberately has no Public IPv4, you'll need to ensure it's still accessible to CloudFront through the VPC origin configuration.  
**Sources**  
[Origin settings - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html)  
[Troubleshoot CloudFront distribution access issues with CNAMEs and custom origins | AWS re:Post](https://repost.aws/knowledge-center/cloudfront-cname-origin)

"The parameter origin name must be a domain name" error when trying to use AWS::CloudFront::VpcOrigin

Add your answer

Relevant content