AWS AmazonCloudFront medium security documentation change
Summary
Updated CNAME setup process to reflect new CloudFront UI workflow, removed references to SSL/IAM certificates, added ACM certificate validation steps, and streamlined instructions
Security assessment
The change enforces TLS certificate usage (replacing SSL references) and adds explicit domain ownership validation through DNS records. It removes deprecated IAM certificate store references in favor of ACM, which provides automatic certificate management. These updates improve security by ensuring proper certificate validation and reducing risks of misconfigured HTTPS.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/CreatingCNAME.md b/AmazonCloudFront/latest/DeveloperGuide/CreatingCNAME.md index 6d12d601c..99285a83b 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/CreatingCNAME.md +++ b//AmazonCloudFront/latest/DeveloperGuide/CreatingCNAME.md @@ -17 +17 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter - * Get an SSL/TLS certificate from an authorized certificate authority (CA) that covers the domain name. Add the certificate to your distribution to validate that you are authorized to use the domain. For more information, see [Requirements for using alternate domain names](./CNAMEs.html#alternate-domain-names-requirements). + * Get a TLS certificate from an authorized certificate authority (CA) that covers the domain name. Add the certificate to your distribution to validate that you are authorized to use the domain. For more information, see [Requirements for using alternate domain names](./CNAMEs.html#alternate-domain-names-requirements). @@ -28 +28 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter - 3. On the **General** tab, choose **Edit**. + 3. On the **General** tab, choose **Add a domain**. @@ -30 +30 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter - 4. Update the following values: + 4. Enter up to five domains to serve. @@ -32 +32 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter -**Alternate Domain Names (CNAMEs)** + 5. Choose **Next**. @@ -33,0 +34 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter + 6. For **TLS certificate** , if CloudFront can't find an existing AWS Certificate Manager (ACM) certificate for your domain in your AWS account in the `us-east-1` AWS Region, you can choose to automatically create a certificate or manually create it in ACM. @@ -35 +36 @@ If you want viewers to use HTTPS with your alternate domain name, see [Use alter -Add your alternate domain names. Separate domain names with commas, or type each domain name on a new line. + 7. When your certificate is provisioned, you must update your DNS records with your DNS provider to prove domain ownership. The entries that you need to make to your DNS records are provided for you in the CloudFront console. @@ -37 +38 @@ Add your alternate domain names. Separate domain names with commas, or type each -**SSL Certificate** + 8. After you update your DNS records, choose **Validate certificate**. @@ -38,0 +40 @@ Add your alternate domain names. Separate domain names with commas, or type each + 9. When the certificate is validated, choose **Next**. @@ -40 +42 @@ Add your alternate domain names. Separate domain names with commas, or type each -Choose the following setting: + 10. Review your changes and choose **Add domains**. @@ -42 +44 @@ Choose the following setting: - * **Use HTTPS** – Choose **Custom SSL Certificate** , and then choose a certificate from the list. The list includes certificates provisioned by AWS Certificate Manager (ACM), certificates that you purchased from another CA and uploaded to ACM, and certificates that you purchased from another CA and uploaded to the IAM certificate store. + 11. On the **General** tab for the distribution, confirm that **Distribution Status** has changed to **Deployed**. If you try to use an alternate domain name before the updates to your distribution have been deployed, the links that you create in the following steps might not work. @@ -44,28 +46 @@ Choose the following setting: -If you uploaded a certificate to the IAM certificate store but it doesn’t appear in the list, review the procedure [Import an SSL/TLS certificate](./cnames-and-https-procedures.html#cnames-and-https-uploading-certificates) to confirm that you correctly uploaded the certificate. - -If you choose this setting, we recommend that you use only an alternate domain name in your object URLs (https://www.example.com/logo.jpg). If you use your CloudFront distribution domain name (https://d111111abcdef8.cloudfront.net.cloudfront.net/logo.jpg), a viewer might behave as follows, depending on the value that you choose for **Clients Supported** : - - * **All Clients** : If the viewer doesn’t support SNI, it displays a warning because the CloudFront domain name doesn’t match the domain name in your TLS/SSL certificate. - - * **Only Clients that Support Server Name Indication (SNI)** : CloudFront drops the connection with the viewer without returning the object. - -**Clients Supported** - - -Choose an option: - - * **All Clients** : CloudFront serves your HTTPS content using dedicated IP addresses. If you select this option, you incur additional charges when you associate your SSL/TLS certificate with a distribution that is enabled. For more information, see [Amazon CloudFront Pricing](https://aws.amazon.com/cloudfront/pricing/). - - * **Only Clients that Support Server Name Indication (SNI) (Recommended)** : Older browsers or other clients that don't support SNI must use another method to access your content. - -For more information, see [Choose how CloudFront serves HTTPS requests](./cnames-https-dedicated-ip-or-sni.html). - - 5. Choose **Yes, Edit**. - - 6. On the **General** tab for the distribution, confirm that **Distribution Status** has changed to **Deployed**. If you try to use an alternate domain name before the updates to your distribution have been deployed, the links that you create in the following steps might not work. - - 7. Configure the DNS service for the alternate domain name (such as www.example.com) to route traffic to the CloudFront domain name for your distribution (such as d111111abcdef8.cloudfront.net). The method that you use depends on whether you’re using Route 53 as the DNS service provider for the domain or another provider. - -###### Note - -If your DNS record already points to a distribution that is not the distribution that you are updating, then you only add the alternate domain name to your distribution after you update your DNS. For more information, see [Restrictions on using alternate domain names](./CNAMEs.html#alternate-domain-names-restrictions). + 12. Configure the DNS service for the alternate domain name (such as www.example.com) to route traffic to the CloudFront domain name for your distribution (such as d111111abcdef8.cloudfront.net). The method that you use depends on whether you’re using Route 53 as the DNS service provider for the domain or another provider. For more information, see [Add a domain to your CloudFront standard distribution](./add-domain-existing-distribution.html). @@ -87 +62 @@ If you already have an existing CNAME record for your alternate domain name, upd - 8. Using `dig` or a similar DNS tool, confirm that the DNS configuration that you created in the previous step points to the domain name for your distribution. + 13. Using `dig` or a similar DNS tool, confirm that the DNS configuration that you created in the previous step points to the domain name for your distribution. @@ -108 +83 @@ The answer section shows a CNAME record that routes queries for www.example.com - 9. Test the alternate domain name by visiting URLs with your domain name instead of the CloudFront domain name for your distribution. + 14. Test the alternate domain name by visiting URLs with your domain name instead of the CloudFront domain name for your distribution. @@ -110 +85 @@ The answer section shows a CNAME record that routes queries for www.example.com - 10. In your application, change the URLs for your objects to use your alternate domain name instead of the domain name of your CloudFront distribution. + 15. In your application, change the URLs for your objects to use your alternate domain name instead of the domain name of your CloudFront distribution.