Unexpected behavior when duplicate Alternate Domain Names (CNAMEs) are configured between two CloudFront distributions

Question

Hello,

I encountered an unexpected behavior related to CloudFront Alternate Domain Name (CNAME) settings and would like to confirm whether this is intended or a possible bug.

Here’s the situation:

There are two ALBs: A ALB and B ALB.

There are also two CloudFront distributions: A CloudFront and B CloudFront.

Normally, some.test.domain should be associated with A CloudFront, which has A ALB as its origin.

Therefore, requests to some.test.domain should be routed to A ALB.

Meanwhile, B CloudFront has B ALB as its origin and handles its own domain correctly.

A CloudFront is configured with an Alternate Domain Name (CNAME) of *.test.domain.
By mistake, I also added some.test.domain as an Alternate Domain Name to B CloudFront.

At that time, Route53 was correctly configured so that some.test.domain pointed to A CloudFront, but in practice, requests to some.test.domain were being routed to B ALB instead.

After some investigation, I discovered that the issue was due to B CloudFront having the incorrect Alternate Domain Name configuration.
Once I removed some.test.domain from B CloudFront’s Alternate Domain Names, without changing any other settings, the requests started going to A ALB as expected.

My question is:
👉 Is this the intended behavior of CloudFront when two distributions have overlapping Alternate Domain Names (CNAMEs)?
Or could this be a bug in the way CloudFront handles domain name resolution in such cases?

Thank you in advance for your help.

(I translated it through translator, and if you need further explanation, please let me know in the comments)

re:Post Agent · Accepted Answer

This behavior is actually the intended functionality of CloudFront when dealing with overlapping alternate domain names (CNAMEs).

When you have two CloudFront distributions with the same alternate domain name configured (in your case, "some.test.domain" was configured on both A CloudFront and B CloudFront), CloudFront's behavior is not determined by your DNS settings in Route 53. Instead, CloudFront has its own internal routing logic.

CloudFront identifies which distribution should handle a request based on the "Host" header in the HTTP request. When a request comes in for "some.test.domain", CloudFront looks at all distributions that have this domain configured as an alternate domain name.

In cases where there's an overlap between a specific domain name and a wildcard domain name (like "some.test.domain" and "*.test.domain"), CloudFront will prioritize the more specific match. In your scenario, "some.test.domain" is more specific than "*.test.domain", so B CloudFront (which had the exact domain configured) was handling the requests instead of A CloudFront (which had the wildcard).

This is why removing "some.test.domain" from B CloudFront resolved the issue - it eliminated the duplicate configuration, allowing the wildcard configuration on A CloudFront to take effect.

It's important to note that CloudFront has restrictions against duplicate alternate domain names across distributions, even if they're owned by the same AWS account. Each alternate domain name must be unique across all CloudFront distributions globally, with the exception of wildcard domains that can overlap with more specific domains (as in your case).  
**Sources**  
[Use custom URLs by adding alternate domain names (CNAMEs) - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html)  
[I remove my cloudfront deployment and create it again. But, When i create new deployment and use my prev domain, it can't access and error is occured. | AWS re:Post](https://repost.aws/questions/QURIhw9ODbQs69EArRtwxRRg/i-remove-my-cloudfront-deployment-and-create-it-again-but-when-i-create-new-deployment-and-use-my-prev-domain-it-can-t-access-and-error-is-occured)

Unexpected behavior when duplicate Alternate Domain Names (CNAMEs) are configured between two CloudFront distributions

Add your answer

Relevant content