What strategy to host thousands of static websites in AWS ?

Question

I am building an app that let an user get a domain name, create a static website associated with this domain and secured with a SSL/TLS certification. My goal is to use the pattern Route 53 -> Cloudfront + Certificate Manager -> S3. The purpose of my app is to server thousands of users and so to generate thousands of domains and static websites.

I am worried that this pattern is not adequate due to some limitations regarding Cloudfront. Therefore, I seasrched for questions already asked here but there are not complet for my use case.
* https://repost.aws/questions/QUJCmEN5YvTdevcBub9nlW5w/hosting-1000s-of-static-sites
* https://repost.aws/questions/QUTw6fN-jXTZ6iDBYpPJ0a8A/how-can-i-avoid-excessive-numbers-of-cloudfront-distributions
* https://repost.aws/knowledge-center/multiple-domains-https-cloudfront

Here is the situation : Only one SSL/TLS certificate can be attached to a Cloudfront distribution and I cannot generate a certificate for all domains since there are created gradually. Therefore, I have to create a cloudfront distribution and a SSL/TLS certificate for each user meaning I would need to create thousands of cloudfront distributions and certificates. I am not sure this is a good practice. Moreover, there is a soft limit of 200 regarding the number of distributions per account (see image below), so is it possible to increase to thousands ?

Furthermore, I would like to store all static websites in the same bucket discriminated by prefix and it  will be the same origin for all Cloudfront distributions. But I saw there is a soft limit of 100 regarding the number of distributions per origin access control (see image below), so is it possible to have only on bucket served by thousands of Cloudfront distributions ? Or should I create multiple buckets ?

![Enter image description here](/media/postImages/original/IMz06lxaI9TUemCE6MnQvXfw)

Answer

Yeah,

You're right, creating thousands of CloudFront distributions and certificates for each user isn't ideal due to limitations and management overhead.

Actually it is having some limitations as follows:

Limitations:

1. Certificate per Distribution: CloudFront allows only one certificate per distribution.

2. Distribution Limit: There's a soft limit of 200 distributions per account (can be increased with AWS Support).

3. Origin Access Identity (OAI) Limit: There's a soft limit of 100 distributions per OAI (can be increased with AWS Support).

For Better Approaches Go through these considerations:

1. Wildcard SSL Certificate: Utilize a wildcard SSL certificate from AWS Certificate Manager (ACM) to secure multiple domains under a single certificate. This covers subdomains of your main domain (e.g., *.hlodomain.com).

2. Lambda@Edge for Domain Routing: Implement a Lambda@Edge function at the CloudFront edge. This function inspects the incoming hostname (user's domain) and routes the request to the appropriate prefix within your single S3 bucket. Here's a helpful guide: https://docs.aws.amazon.com/lambda/latest/dg/lambda-edge.html

What strategy to host thousands of static websites in AWS ?

Relevant content