Cognito : After ading custom domain "View login page URL doesnt work"

Question

Hi,

I added a custom domain, created a cname record entry in route53 with the given CloudFront distribution, and made sure I have the parent entry of the domain as A record in route53. Also ,the certificates are valid but when I click the view login URL it throws a forbidden, and in the UI I see :
"Login pages unavailable
Please contact an administrator."

I tried with multiple domains but faced the same issue again and again. One more thing I observed when I create a custom domain the cognito domain also starts giving the same error, but if I delete the custom domain then the cognito domain works.

if I do  dig A authdev.mydomain.com +short
I get the below response 
d16j6215xzclux.cloudfront.net.
18.161.229.42
18.161.229.127
18.161.229.4
18.161.229.105

I don't see a clear answer to the problem in the community, has anyone used a custom domain successfully?

Regards,
Niks

re:Post Agent · Accepted Answer

The issue you're experiencing with your Cognito custom domain is likely related to a few potential factors:

1. Propagation delay: When you set up a new custom domain or make changes to an existing one, it can take up to an hour for Amazon Cognito to fully distribute and apply the new configuration. This includes propagating the SSL certificate across the CloudFront distribution associated with your custom domain.

2. DNS configuration: Ensure that your CNAME record in Route 53 is correctly pointing to the Alias Target URI provided by Cognito when you create a custom domain, not the Cognito Domain URI. This is a common oversight that can cause issues.

3. Certificate validation: Verify that your ACM certificate is in the us-east-1 (N. Virginia) region, as this is required for Cognito custom domains. Also, double-check that the certificate covers the exact domain name you're using.

4. CloudFront distribution: The custom domain for Cognito uses a CloudFront distribution. Ensure that you have the necessary permissions to update CloudFront distributions, as this is required for creating a custom domain.

To troubleshoot:

1. Wait at least an hour after making any changes before testing again.
2. Verify your Route 53 CNAME record is using the correct Alias Target URI.
3. Check your ACM certificate region and coverage.
4. Clear your browser cache and try accessing from different networks or devices.
5. Ensure your IAM permissions include the ability to update CloudFront distributions.

If the issue persists after these steps, it may be worth contacting AWS support for further assistance, as there could be an underlying service issue.  
**Sources**  
[ACM Cert Not Being Honored By Custom Domain in Cognito | AWS re:Post](https://repost.aws/questions/QUfiJ4tYPyT9Kp4a5yz4xgMg/acm-cert-not-being-honored-by-custom-domain-in-cognito)  
[Insufficient permissions. CloudFront UpdateDistribution permission is required to create a custom domain. | AWS re:Post](https://repost.aws/questions/QUe1ZC67xPT7yPCmXqGHHP9Q/insufficient-permissions-cloudfront-updatedistribution-permission-is-required-to-create-a-custom-domain)

Jacob · Answer

After creating a second app client in a pool, the second app client is not assigned a style by default and will return this error and may be another potential issue, for whatever reason that does not have a warning or different error message 😔

Jacob

answered a year ago

verran · Answer

You need to associate your application in the Managed Login menu, otherwise the redirect will fail with a page not found error. This may be a required step after upgrading to the hosted pages. Enter image description here

verran

answered 9 months ago

Niks · Answer

The issue was that i was not using Hosted UI classic

Cognito : After ading custom domain "View login page URL doesnt work"

Add your answer

Relevant content