AWS AmazonCloudFront high security documentation change
Summary
Added domain verification requirements via TXT records and expanded DNS configuration guidance
Security assessment
The new TXT record requirement (_cf-challenge subdomain) specifically addresses domain ownership verification to prevent unauthorized domain associations. This mitigates risks of domain hijacking/spoofing by ensuring proper validation before routing traffic.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.md b/AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.md index 03e09f76b..ad040ec77 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.md +++ b//AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.md @@ -5 +5 @@ -Add a domain and certificate (distribution tenant)Complete domain setupPoint domains to CloudFront +Add a domain and certificate (distribution tenant)Complete domain setupPoint domains to CloudFrontDomain considerations (distribution tenant) @@ -26,0 +27,2 @@ You can request the certificate when you create or update the distribution tenan + * Domain considerations (distribution tenant) + @@ -72,0 +75,15 @@ Follow these procedures to verify that you own the domain for your distribution +###### Note + +If your domain is already pointed to CloudFront with an Amazon Route 53 alias record, you must add your DNS TXT record with `_cf-challenge.` in front of the domain name. This TXT record verifies that your domain name is linked to CloudFront. Repeat this step for each domain. The following shows an example TXT record: + + * Record name: `_cf-challenge.example.com` + + * Record type: `TXT` + + * Record value: `d111111abcdef8.cloudfront.net` + + + + +Your record will appear as: `_cf-challenge.example.com TXT d111111abcdef8.cloudfront.net` + @@ -144 +161,33 @@ Update your DNS records to route traffic from each domain to the CloudFront rout - 3. Choose **Submit**. This returns you to the distribution tenant page. When your domain is active, CloudFront updates the domain status to indicate that your domain is ready to serve traffic. + 1. Sign in to your domain registrar or DNS provider management console. + + 2. Navigate to the DNS management section for your domain. + + * For subdomains – Create a CNAME record. For example: + + * Name – Your subdomain (such as `www` or `app`) + + * Value / Target – The CloudFront routing endpoint + + * Record type – CNAME + + * TTL – 3600 (or whatever is appropriate for your use case) + + * For apex/root domains – Create an ALIAS record (Route 53) or similar functionality from your DNS provider that allows apex domain redirection. For example, in Route 53: + + * Name – Your apex domain (such as `example.com`) + + * Record type – A + + * Alias – Yes + + * Alias target – Your CloudFront routing endpoint + + * Routing policy – Simple (or whatever is appropriate for your use case) + + 3. Verify that the DNS change has propagated. (This can take 24-48 hours.) Use a tool like `dig` or `nslookup`. + + dig www.example.com + # Should eventually return a CNAME pointing to your CloudFront routing endpoint + + 3. Return to the CloudFront console and choose **Submit**. This returns you to the distribution tenant page. When your domain is active, CloudFront updates the domain status to indicate that your domain is ready to serve traffic. + @@ -147,0 +197 @@ Update your DNS records to route traffic from each domain to the CloudFront rout +## Domain considerations (distribution tenant)