title: “CloudFront Custom Domain vs Default URL” created: 2026-10-23 updated: 2026-10-28 type: knowledge tags:

aws
certification
architecture
cloudfront
s3
dns
acm

CloudFront Custom Domain vs Default URL

Realized (2026-10-28): the bhu-docs public site made exactly this migration — from the default *.cloudfront.net URL to the custom domain mimifasol.com / docs.mimifasol.com (Route 53 + ACM, apex Alias). The step-by-step procedure is the runbook [[deploy-custom-domain-route53-acm-cloudfront]]; this note is the concept behind it.

What It Is

When you serve a static site from S3 + CloudFront, you can reach it either through the default CloudFront URL that AWS generates (e.g. d1234xyz.cloudfront.net) or through a custom domain you own (e.g. docs.example.com). Both serve the exact same content from the same distribution. The difference is the address and the plumbing (DNS + TLS certificate) required behind it.

Why It Matters

Choosing between them is a classic first decision when hosting a static site cheaply on AWS. It affects setup effort, recurring cost, and whether the URL is memorable and “yours”. It is also a common certification topic (CloudFront, ACM, Route 53 alias records). Importantly, the choice is not irreversible — you can start with the default URL and add a custom domain later with no rebuild.

Key Concepts

Default CloudFront URL

Provided automatically the moment the distribution is created — no configuration.
HTTPS works immediately: AWS manages the TLS certificate for *.cloudfront.net at no cost.
The URL is not memorable, not “yours”, and changes if the distribution is recreated.

Custom Domain

Requires three pieces of plumbing wired to the existing distribution:

Piece	Detail
ACM certificate	Public TLS cert for your domain. Must be requested in `us-east-1` (CloudFront only reads ACM certs from N. Virginia). Free. Validated via a DNS CNAME record; auto-renews for life.
CloudFront config	Add the domain under Alternate domain names (CNAMEs) and attach the ACM certificate.
DNS record	Point the domain at the distribution (alias or CNAME — see below).

DNS Options for a Custom Domain

Route 53: use an Alias A (and AAAA for IPv6) record to the distribution. AWS-specific, free, and able to point an apex (root) domain at CloudFront.
External DNS (OVH, Gandi, Cloudflare): use a CNAME from docs.example.com to d1234xyz.cloudfront.net. Works well for a subdomain.
Apex / root domain: a plain CNAME at the root is forbidden by the DNS standard. Use Route 53 alias, a registrar that offers CNAME flattening / ALIAS, or simply prefer a subdomain (docs.) to avoid the problem entirely.

How It Works

Both options terminate at the same CloudFront distribution, which pulls objects from a private S3 bucket (ideally locked down with Origin Access Control). The only thing that changes is how the request’s hostname is resolved and which TLS certificate CloudFront presents:

Default URL → DNS for *.cloudfront.net is AWS-managed, cert is AWS-managed. Zero setup.
Custom domain → your DNS resolves your hostname to the distribution, and CloudFront presents the ACM cert you attached for that hostname.

Examples

Cost comparison (low personal traffic: a few visitors/day, a few MB)

Item	Default URL	Custom Domain
CloudFront egress	~$0 (free tier)	~$0 (free tier)
S3 storage (few MB)	a few cents	a few cents
ACM certificate	—	Free
Route 53 hosted zone	—	$0.50/month per zone (only if DNS is on Route 53)
Domain name	—	~$10–15/year, varies by TLD

Net: default URL ≈ $0. Custom domain ≈ price of the domain + $0 to $0.50/month depending on where DNS is hosted. The certificate is never a cost.

Migrating from default URL to custom domain later

No rebuild needed — it is an additive config change on the existing distribution:

Request an ACM certificate in us-east-1 for the domain.
Add the domain under Alternate domain names and attach the cert.
Create the DNS record (alias or CNAME) pointing at the distribution.

The S3 bucket, distribution, content, and build pipeline stay identical. The *.cloudfront.net URL keeps working in parallel.

Gotchas

ACM region trap: the certificate for CloudFront must live in us-east-1, even if the bucket/content is elsewhere. A cert in another region will not appear in the CloudFront dropdown.
Apex CNAME is illegal: cannot put a plain CNAME on the root domain. Use Route 53 alias, CNAME flattening, or a subdomain.
Adding a domain to CloudFront without also configuring the matching ACM cert will fail TLS.
Route 53 charges $0.50/month per hosted zone regardless of traffic — keep DNS on an external registrar to avoid it if cost is the priority.
The default URL is tied to the distribution; recreate the distribution and the URL changes. A custom domain is stable across rebuilds.

AWS Certification Notes