DNS management

• Always prefer a CNAME record to forward one domain or subdomain to another domain.
• Never point a record to an IP address.
• If it is absolutely necessary to use an IP address then switch to an Elastic IP address.
• To redirect a root domain to any subdomain use services like Amazon S3 and/or CloudFront rather than handled in your application code level or in the Nginx or Apache servers.

Elastic IP address

• You can mask the failure of an instance or software by rapidly remapping the address to another instance in your account.
• It is allocated to your AWS account and is yours until you release it.
• It does not change over time and can be maintained across.

Allocating an Elastic IP address

• Amazon’s pool of IPv4 addresses
• A pool that you own and bring to your account
• A pool that you own and continue to advertise

1. Open the Amazon EC2 console.
2. In the navigation pane, choose Elastic IPs.
3. Choose Allocate a new address.
4. Choose an option from the required public IPv4 pool or use global IP addresses from AWS Global Accelerator. For the IPv4 address pool, choose Amazon pool.
5. Choose Allocate, and close the confirmation screen.

• Currently, Elastic IP addresses are not supported for IPv6.
• By default, all AWS accounts are limited to five (5) Elastic IP addresses per region. The limit is not applicable when you allocate it from a pool of IP addresses that you have brought to your AWS account.

Associating an Elastic IP address with a running instance

1. Open the Amazon EC2 console.
2. In the navigation pane, choose Elastic IPs.
3. Select an Elastic IP address and choose Actions -> Associate Elastic IP address.
4. Select the instance from Instance and then choose Associate.

Site redirection using Amazon S3, CloudFront, and Route 53

Creation of Amazon S3 bucket

1. Open the Amazon S3 console.
2. Choose Create Bucket, it will open a wizard.
3. In Bucket name, enter a DNS-compliant name for your bucket.
4. In Region, choose the AWS Region where you want the bucket to reside.
5. In Bucket settings for Block Public Access, make sure you uncheck the Block Public Access settings for your bucket.
6. Choose Create bucket.
• After creation bucket name can’t be changed.

Enable static website hosting

1. Open the Amazon S3 console.
2. Under Buckets, choose the name of the bucket that you want to redirect requests from (for example, some-website.com).
3. Choose Properties.
4. Under Static website hosting, choose Edit.
5. Choose Enable for static website hosting.
6. Choose Redirect requests for an object for hosting type.
7. Enter the hostname you want to redirect the request to.
8. Choose the Protocol (optional).
9. Choose Save changes.
• Have a CNAME record created for the hostname you want to redirect the request to.

Add bucket policy

1. Open the Amazon S3 console.
2. Under Buckets, choose the name of your bucket.
3. Choose Permissions.
4. Under Bucket Policy, choose Edit.
5. Copy the following bucket policy, and paste it into the Bucket policy editor, this will grant public read access to your website.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::some-website.com/*"
      ]
    }
  ]
}

6. To use this bucket policy with your own bucket, you must update some-website.com in Resource to match your bucket name.
7. Choose Save changes.
• After adding the policy check the bucket endpoint once to verify if everything is working as intended. Inside your bucket, head to Properties -> Static website hosting -> Bucket website endpoint.

Generate SSL Certificates using AWS Certificate Manager

• Certificates provided by AWS Certificate Manager.
• Certificates that you purchased from a third-party certificate authority and uploaded to ACM.
• Certificates that you purchased from a third-party certificate authority and uploaded to the IAM certificate store.

1. Open the AWS Certificate Manager console.
2. Choose Request a certificate.
3. On the Request a certificate page, choose Request a public certificate followed by Request a certificate CTA to continue.
4. On the Add domain names page, type your domain name that you want to provide a certificate for. You can either use a subdomain name, such as www.some-website.com, or a root domain name such as some-website.com.
• You can also use an asterisk(*)as a wild card to protect several site names in the same domain. For example, .some-website.com protects www.some-website.com, and login.some-website.com.
• When you request a wild card certificate, the asterisk (*)must be in the leftmost position of the domain name and can protect only one subdomain level. For example, .some-website.com can protect www.some-website.com, and login.some-website.com, but it cannot protect www.login.some-website.com. Also, note that .some-website.com protects only the subdomains of some-website.com, it does not protect the root domain (some-website.com).
5. To add another name, choose Add another name to this certificate and type the name in the text box. This is useful for protecting both a root domain (such as some-website.com) and its subdomains such as .some-website.com).
6. Choose Next when you finish adding the domain names.
7. On the Select validation method page, choose either DNS validation or Email validation. We recommend that you use DNS validation rather than email validation if you have permission to modify the DNS configuration for the domains in your certificate request. For the scope of this article, we will use DNS validation.
8. On the Add tags page, you can optionally tag your certificate.
9. Review the certificate and click Confirm and request.
10. You must complete the validation before ACM can issue your certificate, expand the panel with the domain name and add the CNAME record to the DNS configuration for your domain.
11. If you are using Route 53 as your DNS management tool then choose Create record in Route 53 and ACM will update your DNS configuration for you.
12. Click Create to create a record in Route 53.

Create a CloudFront distribution

1. Open the CloudFront console
2. Choose Create Distribution.
3. On the Select a delivery method for your content page, under Web, choose Get Started.
4. On the Create Distribution page, in the Origin Settings section, for Origin Domain Name, enter the Amazon S3 website endpoint for your bucket. CloudFront fills in the Origin ID for you.
5. For Default Cache Behavior Settings, keep the values set to the defaults.
6. For Distribution Settings, keep the default values except the following fields,
• Set Alternate Domain Names (CNAMEs) to the root domain and subdomain, for example, some-website.com and www.some-website.com.
• For SSL Certificate, choose Custom SSL Certificate (example.com), and choose the custom certificate that covers the domain and subdomain names. You must have created that in the previous step.
7. Choose Create Distribution.
• Once your distribution is deployed, you can reference your content with the new CloudFront domain name. It can be checked in the Status column.
• Verify that your CloudFront distribution is working, enter the domain name of the distribution in a web browser.

Add alias record in Route 53

1. Open the Route 53 console.
2. Choose Hosted zones and select the name of hosted zone from the list that matches your root domain.
3. Choose Create record.
4. Choose Simple routing, and choose Next.
5. Choose Define simple record.
6. In Record name, leave it as it is for the root domain. For subdomain, like www.some-website.com input www.
7. In Value/Route traffic to, choose Alias to CloudFront distribution for Cloudfront. For adding via the S3 bucket choose Alias to S3 website endpoint.
8. Choose the Region, for example, Asia Pacific (Mumbai) [ap-south-1].
9. Based on the selection of value/route traffic to, either choose the distribution, for example, dkvtdk7jiydzr.cloudfront.net or S3 bucket, for example, s3-website.ap-south-1.amazonaws.com (some-website.com)
10. In Record type, choose A ‐ Routes traffic to an IPv4 address and some AWS resources.
11. Disable the Evaluate target health.
12. Choose Define simple record.
• Verify that the redirection is working properly. If it is not, try clearing the browser cache and compare the name server for the hosted zone and your domain is correct.
• For the S3 bucket to appear in the list, your S3 bucket name and Route 53 record name should be the same.
• Amazon S3 does not support HTTPS access to the website. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3.

1. How DNS works
2. Learn more about Elastic IP address
3. DNS hostnames
4. AWS Global Accelerator
5. Benefits over email validation
6. What is Amazon CloudFront?