Using custom domain name for CloudFront Distribution with an HTTP API

Hello folks,

Based on some examples I tried to setup a CloudFront distribution with a custom domain name and an HTTP API (Apigateway) as origin. Unfortunately, I receive a 403 Forbidden when trying to access the Cloudfront distribution. Also, when I try to setup everything manually in the AWS console, I don't get a ApiGateway listed in the list of possible origins for a distribution.

Here is my setup:

DomainName: example.com

HTTP-API

• Invoke URL: abc1.amazonaws.com
• Domain Endpoint: abc2.amazonaws.com
• Route53 A-Record: some-api.example.com

CloudFront Distributon:

• Endpoint: def1.cloudfront.net
• Alternative domain name: public.example.com
• Route53 Alias-Record: public.example.com
• Origin: some-api.example.com

Certificates

• Certificate in us-east-1 for CloudFront (example.com, *.example.com)
• Certificate in eu-central-1 for HTTP API (example.com, *.example.com)

✅ When accessing the HTTP API through its Route53 configured subdomain, the request works fine and the lambda behind it is invoked

curl --location --request GET 'https://some-api.example.com/test'
curl --location --request GET 'https://abc1.amazonaws.com/test'

🚫 When accessing the HTTP API through CloudFront's Route53 mapping OR through CloudFront's endpoint, its giving back a 403 Forbidden:

curl --location --request GET 'https://public.example.com/test' ===> {"message":"Forbidden"}
curl --location --request GET 'https://def1.cloudfront.net/test' ===> {"message":"Forbidden"}

Behaviour Configuration in CloudFront

Account Setup

I'm using this setup in a sub-account, managed by AWS Identity Center and having a Landing Zone that governs eu-central-1 and us-east-1 region. The respective user I'm using for setting up everything has Administrator permissions.

I think, I followed those posts very closely but did I overlook something? https://repost.aws/knowledge-center/api-gateway-domain-cloudfront https://repost.aws/knowledge-center/api-gateway-authentication-token-errors