How do I resolve the "CNAMEAlreadyExists" error when I set up a CNAME alias for my CloudFront distribution?

Short description

You can't use the same CNAME alias for more than one CloudFront distribution. When the CNAME alias that you set up is already associated with another CloudFront distribution, you receive the following error:

"One or more of the CNAMEs you provided are already associated with a different resource. (Service: AmazonCloudFront; Status Code: 409; Error Code: CNAMEAlreadyExists; Request ID: a123456b-c78d-90e1-23f4-gh5i67890jkl*"

To get information about the distribution and the AWS account ID for the conflicting CNAME, run the list-conflicting-aliases AWS Command Line Interface (AWS CLI) command. Make sure that your target distribution has an AWS Certificate Manager (ACM) certificate associated with your CNAME record in the us-east-1 AWS Region.

Note: The list-conflicting-aliases operation requires the following AWS Identity and Access Management (IAM) permissions:

{  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudFrontCnameSwapSameAcc",
      "Effect": "Allow",
      "Action": [
        "cloudfront:GetDistribution",
        "cloudfront:ListConflictingAliases"
      ],
      "Resource": [
        "arn:aws:cloudfront::TargetAcccount:distribution/TargetDistroID"
      ]
    }
  ]
}

To resolve this issue, use the option based on your configuration.

Option 1: Same account CNAME swap

For source and target distributions that are in the same account, see the Move your CNAME section.

Option 2: cross-account CNAME swap

For cross-account source and target distributions, see the Turn off the source distribution with the conflicting CNAME section.

Option 3: Cross-account wildcard CNAME swap

If you can't deactivate the source distribution, then see the Use a wildcard to move the alternate domain name section.

Note: You can't use a wildcard to move an apex domain. To move an apex domain when the source and target distributions are in different accounts, see Contact Support to move an alternate domain name.

Resolution

Move your CNAME

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To move the CNAME, make sure that you have access to both the source distribution and target distribution they must be in the same AWS account.

Complete the following steps:

1. In the IAM policy of the user or role that makes the API request, add the following resource-level permissions:

   {  "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "CloudFrontCnameSwapSameAcc",
         "Effect": "Allow",
         "Action": [
           "cloudfront:UpdateDistribution",
           "cloudfront:UpdateDistributionTenant",
           "cloudfront:UpdateDomainAssociation"
         ],
         "Resource": [
           "arn:aws:cloudfront::TargetAcccount:distribution/TargetDistroID"
         ]
       }
     ]
   }
   

2. (Optional) If you move an alternate domain name within the same AWS account, then skip this step. Create a DNS TXT record for the CNAME that resolves the target distribution's canonical name to verify ownership. Your TXT record must include an underscore before the CNAME, apex, or wildcard:

   _cname.example.com.  900   IN   TXT     "dexample123456.cloudfront.net"
   _.example.com.   900   IN   TXT     "dexample123456.cloudfront.net"
   _*.example.com.  900   IN   TXT     "dexample123456.cloudfront.net"
   

   Note: The domain apex varies by top-level domain (TLD). for example, TLDs with country codes include the country code in its apex:

   CNAME: www.example.com | Apex: example.com
   CNAME: www.example.co.uk | Apex: example.co.uk

3. Associate your target distribution with an ACM certificate created in the us-east-1 Region with the CNAME record. For more information, see How do I troubleshoot issues when I use a custom SSL certificate for my CloudFront distribution?
   Note: The subject name or subject alternative name must match or overlap with the CNAME alias. It's a best practice to have a valid certificate that's issued from ACM or a trusted certificate authority (CA) that's listed in Mozilla's certificate list. For more information, see Certificate Authorities on the Mozilla website.

4. To move the CNAME from the existing distribution to the new distribution, run the following update-domain-association command for your distribution type:
   Important: If the source and target distributions are in different AWS accounts, then additional configuration is required. Turn off the source distribution with the conflicting CNAME section before you run the update-domain-association command.
   Standard distribution

   aws cloudfront update-domain-association --domain cname.example.com --target-resource YourDistributionId
   

   Note: Replace YourDistributionId with your target distribution's ID for a target standard distribution.
   CloudFront SaaS Manager distribution

   aws cloudfront update-domain-association --domain cname.example.com --target-resource YourDistributionTenantId

   Note: Replace YourDistributionTenantId with your target distribution's tenant ID for a target tenant distribution. Replace cname.example.com with your domain name.

5. Update the DNS record for the CNAME to route traffic to the target distribution's canonical name:

   cname.example.com.         86400   IN   CNAME     "dexample123456.cloudfront.net"
   

6. Wait for DNS propagation to complete.

Turn off the source distribution with the conflicting CNAME

If the source and target distributions are in different AWS accounts, then turn off the source distribution that's associated with the conflicting domain. Then, follow the steps in the Move your CNAME section.

Complete the following steps:

To turn off the source distribution that's associated with the conflicting domain, complete the following steps:

1. Open the CloudFront console.
2. In the navigation pane, choose Distributions.
3. Select the source distribution, and then choose Disable.

Note: If you don't have access to the account that contains the source distribution or you can't deactivate the source distribution, then contact AWS Support.

Use a wildcard to move the alternate domain name

If your source and target distributions are in different accounts but you can't deactivate the source distribution, then use a wildcard to move the CNAME.

In the following procedure, wait for each distribution to fully deploy the updates before you proceed to the next step.

Complete the following steps:

1. Update the target distribution to add a wildcard CNAME for the alternate domain name that you require to move. For example, if your domain is cname.example.com, then add the wildcard alternate domain name *.example.com to the target distribution.
   Note: You must have an SSL/TLS certificate on the target distribution that secures the wildcard domain name.

2. Update the DNS record for the CNAME to route traffic to the target distribution's canonical name:

   cname.example.com.         86400   IN   CNAME     "dexample123456.cloudfront.net"
   

   Note: Because the alternate domain name is still associated with the source distribution, the source distribution receives the requests that use the alternate domain name. The target distribution receives the requests only after you remove the alternate domain name from the source distribution.

3. Update the source distribution to remove the alternate domain name.
   Note: During the update, there's no interruption to the live traffic. Because the requested domain name matches the wildcard domain that you added to the target distribution, live traffic uses the target distribution settings.

4. To add the alternate domain name that you require to move, update the target distribution.

5. To confirm the DNS record for the CNAME, run a dig command or a similar DNS query tool:

   dig CNAME cname.example.com +shortnslookup example.com

Related information

Actions, resources, and condition keys for Amazon CloudFront

Move the alternate domain name