AWS ACM SSL/TLS Certificate with CloudFront and S3

Purpose of This Lesson

This lesson demonstrates an end-to-end workflow for serving a static website stored in Amazon S3 through Amazon CloudFront using a custom domain name and an SSL/TLS certificate issued by AWS Certificate Manager (ACM).

The workflow combines:

• An S3 bucket containing an index.html file, CSS, and images.
• A public ACM certificate for the custom domain.
• DNS validation through an Amazon Route 53 hosted zone.
• A CloudFront distribution using the S3 bucket as its origin.
• CloudFront Origin Access Control (OAC) to authorize access to S3.
• HTTP-to-HTTPS redirection.
• A Route 53 alias record pointing the custom domain to CloudFront.

Key Concepts

AWS Certificate Manager public certificate

ACM can issue a public SSL/TLS certificate for a domain name. The certificate must be validated before it can be used. In this workflow, DNS validation is selected.

DNS validation

DNS validation proves control of the domain by requiring a validation record to be created in the domain’s hosted zone. When the hosted zone is in Route 53, ACM can create the required record automatically using Create records in Route 53.

DNS validation is preferred in this lab because it is more reliable operationally than waiting for an email-based validation process.

CloudFront alternate domain name

The custom domain must be configured as a CloudFront alternate domain name. The ACM certificate selected for the distribution must cover that domain.

CloudFront Origin Access Control

OAC allows CloudFront to access objects in an S3 bucket through an authorization relationship rather than leaving the content broadly accessible. CloudFront provides a bucket policy that must be applied to the S3 bucket.

Default root object

Setting index.html as the CloudFront default root object causes requests to the distribution’s root path to serve that file.

Route 53 alias record

A Route 53 alias record maps the custom domain to the CloudFront distribution. This lets users access the site with the intended domain instead of using the distribution’s generated domain name.

Certificate, CloudFront, and DNS Configuration Workflow

1. Prepare the S3 origin

Create a unique S3 bucket and upload the static website files. The lab content includes:

• index.html
• A CSS stylesheet
• An images folder

The files are placed at the bucket’s top level so that the default root object can resolve correctly.

2. Request the ACM certificate

In AWS Certificate Manager:

1. Request a new certificate.
2. Select Public certificate.
3. Enter the custom domain name associated with the Route 53 hosted zone.
4. Select DNS validation.
5. Submit the request.

The initial certificate status is Pending validation.

3. Create the validation record

Open the pending certificate and select Create records in Route 53. ACM supplies a validation record containing a name and value. After the record is created in the hosted zone, return to ACM and refresh the certificate status.

Validation may not be immediate. Once successful, the certificate status changes to Issued.

4. Create the CloudFront distribution

Configure the distribution with the following settings:

• Origin: The S3 bucket containing the website files.
• Origin access: Create and use an Origin Access Control.
• Viewer protocol policy: Redirect HTTP to HTTPS.
• Web Application Firewall: Do not enable WAF for this lab.
• Alternate domain name: The custom domain from the Route 53 hosted zone.
• SSL certificate: The issued ACM certificate.
• Default root object: index.html.
• Cache policy: The standard caching-optimized option used in the lab.

CloudFront may report that the S3 bucket policy needs to be updated after the distribution is created.

5. Apply the OAC bucket policy

In the S3 bucket, open Permissions, edit the bucket policy, and paste the policy supplied by CloudFront. The important elements of the policy are:

• Effect: Allow
• Principal service: cloudfront.amazonaws.com
• Action: s3:GetObject
• Resource: Objects inside the S3 bucket
• Condition: The request’s source ARN matches the specific CloudFront distribution

This policy allows the intended CloudFront distribution to retrieve objects from S3.

6. Create the Route 53 alias record

After the certificate validation record is no longer needed for the application flow, create the application DNS record in Route 53:

1. Create a record for the custom domain.
2. Select an alias record.
3. Route traffic to the CloudFront distribution.
4. Select the distribution and create the record.

The alias record allows the custom domain to resolve to CloudFront without pointing users directly to the S3 bucket.

7. Test HTTPS and redirection

After the CloudFront distribution finishes deploying:

• Open the CloudFront distribution domain using HTTPS.
• Open the custom domain using HTTPS.
• Open the custom domain using HTTP and confirm that CloudFront redirects the request to HTTPS.
• Confirm that the rendered content comes from index.html and that the CSS and images load correctly.

CloudFront deployment can take time. A distribution may still display a deploying state even when it is already responding to requests.

Exam- or Assessment-Relevant Takeaways

• Use ACM to request and manage the public SSL/TLS certificate used by the CloudFront distribution.
• For a Route 53-managed domain, DNS validation is the practical validation choice demonstrated in this workflow.
• A certificate must reach the Issued state before it can be selected for CloudFront.
• The custom domain must be configured as a CloudFront alternate domain name.
• Configure CloudFront to redirect HTTP to HTTPS when secure access is required.
• When CloudFront uses an S3 origin with OAC, update the S3 bucket policy so the intended CloudFront service principal and distribution can perform s3:GetObject.
• Set index.html as the default root object when the distribution should serve that file for root requests.
• Use a Route 53 alias record to direct the custom domain to CloudFront.
• CloudFront deployment is asynchronous; allow time for the distribution to become fully available.
• Cleanup order matters: disable the CloudFront distribution, wait for it to become disabled, delete it, and then remove the ACM certificate if it is no longer bound to the distribution.

Tool / Feature Decision Guide

Requirement	Feature or choice	Why it fits
Prove control of a Route 53-managed domain	ACM DNS validation	The validation record can be created directly in Route 53 and avoids relying on email delivery.
Serve S3 content securely through a CDN	CloudFront with an S3 origin	CloudFront provides distribution, caching, custom-domain support, and HTTPS configuration.
Restrict S3 retrieval to CloudFront	Origin Access Control	The bucket policy can authorize the CloudFront service for the specific distribution.
Force encrypted viewer connections	Redirect HTTP to HTTPS	HTTP requests are redirected to the HTTPS endpoint using the configured certificate.
Make the website root serve the landing page	Default root object index.html	Requests to the distribution root resolve to the static entry page.
Point a hosted domain to CloudFront	Route 53 alias to CloudFront	The custom domain routes to the distribution without using a direct S3 endpoint.
Avoid an additional security layer for this simple lab	Do not enable WAF	The lab does not require WAF; enabling it would be an additional configuration choice rather than part of the demonstrated setup.

Common Traps / Misconceptions

• A requested certificate is not immediately usable. A certificate in Pending validation is not ready for CloudFront. Wait until ACM shows Issued.
• Uploading website files is not enough. The S3 content, CloudFront distribution, certificate, OAC policy, and DNS record all have to align.
• The certificate alone does not create the custom domain route. Route 53 still needs an alias record that points the domain to CloudFront.
• The S3 bucket policy cannot be skipped when using OAC. CloudFront indicates that the policy must be updated; apply the supplied policy in S3 permissions.
• The default root object is easy to overlook. Without index.html configured as the default root object, a request to the distribution root may not produce the expected landing page.
• HTTP redirection must be configured explicitly. Selecting a certificate does not by itself communicate the desired viewer protocol policy.
• CloudFront deployment is not instantaneous. The distribution can take time to deploy, and status updates may lag behind actual response availability.
• Do not delete the certificate first during cleanup. A certificate still associated with a distribution may not be deletable until the distribution is removed.

Real-World Engineer / Analyst Notes

• Keep the ACM certificate, CloudFront alternate domain name, and Route 53 record synchronized. A mismatch in the domain name can prevent the custom HTTPS endpoint from working.
• When troubleshooting, verify the configuration in layers: certificate status, CloudFront deployment status, alternate domain and certificate selection, OAC bucket policy, Route 53 alias, and the HTTP-to-HTTPS behavior.
• Test both the CloudFront-generated domain and the custom domain. This helps isolate whether the problem is in CloudFront itself or in the custom DNS configuration.
• Confirm that static assets use the expected paths. An index.html page can appear to work while its CSS or images fail because the objects were uploaded to unexpected locations.
• For temporary labs, begin cleanup with CloudFront because it has the longest lifecycle transition. Disable it, wait until it is disabled, delete it, and then remove the certificate and S3 resources that are no longer needed.

Quick Reference Summary

1. Create an S3 bucket and upload index.html, CSS, and images.
2. Request a public certificate in ACM for the Route 53-managed custom domain.
3. Use DNS validation and create the validation record in Route 53.
4. Wait for the certificate status to become Issued.
5. Create a CloudFront distribution with the S3 bucket as origin.
6. Configure OAC and apply the generated S3 bucket policy.
7. Set HTTP to redirect to HTTPS.
8. Add the custom domain as an alternate domain name and select the ACM certificate.
9. Set index.html as the default root object.
10. Create a Route 53 alias record pointing the custom domain to CloudFront.
11. Test HTTPS, HTTP redirection, and static asset loading.
12. For cleanup, disable and delete CloudFront before deleting the associated certificate.

Flashcards

Q: A public ACM certificate for a Route 53-managed domain remains in Pending validation. What is the next configuration step?

A: Create the ACM-provided DNS validation record in the Route 53 hosted zone, preferably using Create records in Route 53, and wait for ACM to change the status to Issued.

Q: Why is DNS validation used instead of email validation in this workflow?

A: DNS validation is more reliable for the demonstrated Route 53-managed domain because the required record can be created directly in the hosted zone rather than depending on email delivery.

Q: Which CloudFront setting allows the custom domain to use the ACM certificate?

A: Add the domain as a CloudFront alternate domain name and select the issued ACM certificate that covers that domain.

Q: A CloudFront distribution uses an S3 origin and OAC, but object requests fail. What should you inspect first?

A: Inspect the S3 bucket policy and verify that it allows the CloudFront service principal to perform s3:GetObject on the bucket objects under the condition for the correct distribution source ARN.

Q: When should CloudFront Origin Access Control be selected in this lab?

A: Select OAC when CloudFront should access the S3 origin through an authorization relationship controlled by an S3 bucket policy, rather than relying on unrestricted object access.

Q: What setting makes a request to the CloudFront root return the static landing page?

A: Set the CloudFront default root object to index.html.

Q: How do you force viewers to use HTTPS?

A: Set the CloudFront viewer protocol policy to redirect HTTP to HTTPS.

Q: What AWS DNS record connects the custom domain to CloudFront?

A: A Route 53 alias record that routes traffic to the selected CloudFront distribution.

Q: A CloudFront distribution is still shown as deploying, but its distribution domain responds successfully. What should you infer?

A: The distribution may already be serving requests even though deployment status has not fully updated; continue testing while allowing time for deployment completion.

Q: Compare the ACM validation record with the application DNS record.

A: The ACM validation record proves domain ownership to ACM. The application alias record directs the custom domain’s traffic to CloudFront; they serve different purposes.

Q: What is the decisive difference between the CloudFront distribution domain and the custom domain in this lab?

A: The distribution domain is supplied by CloudFront, while the custom domain is made usable through the alternate domain name, ACM certificate, and Route 53 alias record configuration.

Q: Why might the ACM certificate be unavailable for deletion during cleanup?

A: It may still be associated with the CloudFront distribution. Disable and delete the distribution first, then remove the certificate.

Q: What is the cleanup order for the CloudFront portion of the lab?

A: Disable the distribution, wait until it becomes disabled, delete it, and then delete the ACM certificate if it is no longer needed.

Practice Questions

Question 1

A team has an S3 bucket containing index.html and wants users to browse to the root of a CloudFront distribution and receive that file. Which setting is required?

A. ACM email validation
B. CloudFront default root object set to index.html
C. Route 53 validation record pointing to S3
D. WAF enabled on the distribution

Correct answer: B

The decisive clue is that the requested root path must resolve to the static entry file, which is controlled by CloudFront’s default root object.

Question 2

An ACM certificate for a domain in Route 53 is requested, but CloudFront cannot use it yet. ACM shows Pending validation. What should the engineer do?

A. Create the CloudFront alias record immediately
B. Upload the certificate to the S3 bucket
C. Create the ACM DNS validation record in Route 53 and wait for Issued
D. Change the CloudFront origin to the Route 53 hosted zone

Correct answer: C

A certificate must complete validation and show Issued before it can be selected for the CloudFront HTTPS configuration.

Question 3

A CloudFront distribution uses OAC for an S3 origin. The distribution has deployed, but requests for objects return access errors. Which change is most appropriate?

A. Add the CloudFront-provided OAC bucket policy to the S3 bucket
B. Replace the ACM certificate with an email-validated certificate
C. Change the default root object to the CloudFront distribution ID
D. Create a second Route 53 hosted zone

Correct answer: A

OAC requires the S3 bucket policy to authorize the CloudFront service principal to retrieve objects for the specific distribution.

Question 4

Users can access the CloudFront-generated domain over HTTPS, but the intended custom domain does not resolve to the distribution. Which missing component is the most likely cause?

A. An S3 images folder
B. A Route 53 alias record targeting CloudFront
C. A second default root object
D. A WAF web ACL

Correct answer: B

The custom domain requires a Route 53 alias record that routes traffic to the CloudFront distribution.

Question 5

An engineer wants HTTP requests to the custom domain to switch automatically to HTTPS. Which CloudFront configuration should be selected?

A. Allow HTTP and HTTPS
B. Redirect HTTP to HTTPS
C. Disable the alternate domain name
D. Use S3 static website hosting as the viewer protocol policy

Correct answer: B

The viewer protocol policy Redirect HTTP to HTTPS produces the required behavior while using the configured ACM certificate for the secure request.

WordPress Metadata

Suggested Slug:
aws-acm-ssl-tls-certificate-cloudfront-s3-lab

Meta Description:
Learn how to validate an ACM public certificate with Route 53 and use it with CloudFront to securely serve an S3-hosted website over HTTPS.

Tags:
AWS Certificate Manager, ACM, SSL TLS, Amazon CloudFront, Amazon S3, Amazon Route 53, DNS validation, Origin Access Control, HTTPS, AWS security, SOA-C03