SES config set with custom domain getting http error 400

Question

I am configuring a custom domain to handle open and click tracking, I follow the documentation and everything seems correct, but I am getting http 400 error when redirect to the awstrack.com url.

Documentation:
https://docs.aws.amazon.com/ses/latest/dg/configure-custom-open-click-domains.html

1 - Custom sub domain `link.domain.com` redirection to `r.sa-east-1.awstrack.me`
2 - Using route 53, with A alias to cloudfront, cloudfront with https and custom domain link.domain.com, cloudfront connected to a s3 using website to redirect to `r.sa-east-1.awstrack.me`.
3 - SES config set changed to use the domain `link.domain.com`
4 - Sending emails using the SES (sa-east-1 region), with config set, it is generating open/click events with the custom domain `link.domain.com`

Here and example of link generated in one of the emails sent (where it looks ok):
https://link.domain.com/CL0/https:%2F%2Fgoo.gl%2Fmaps/1/01030181e3dbf7cb-7eb95765-70b3-40bf-aad2-79b4667907e3-000000/l5QlO8RLGNlcYSV4os5PuGMo4lQbY6Ne1CCNhdoOk3w=62

Then I think it "correctly" redirects to `r.sa-east-1.awstrack.me`:
https://r.sa-east-1.awstrack.me/CL0/https:%2F%2Fgoo.gl%2Fmaps/1/01030181e3dbf7cb-7eb95765-70b3-40bf-aad2-79b4667907e3-000000/l5QlO8RLGNlcYSV4os5PuGMo4lQbY6Ne1CCNhdoOk3w=62

But the awstrack.me link above doesn't work, it returns the 
This page isn’t working: HTTP ERROR 400

Anyone has experience with custom domain in config sets for open/click events?

Answer

I was facing error 400 after enabling custom redirect domain (using CloudFront as CDN for https support).

I've followed the instructions described in the doc: https://docs.aws.amazon.com/ses/latest/dg/configure-custom-open-click-domains.html
(Option 2: Configuring an HTTPS domain)
Which by the way doesn't mention the need to use S3 to redirect. I didn't use, followed exact what the doc says.

The problem was related to a missing CloudFront configuration. The issue was solved after defining an "Origin request policy" - set to "AllViewer" (Origin behavior section).

After this, all started to work as expected (for http and https).

SES config set with custom domain getting http error 400

Relevant content