Route53 weighted routing to two separate CloudFront distributions with SSL

This looks really good, thanks. I'm just building a POC on this and if that's successful I will mark this as the Accepted Answer.

Well, I've set up a POC for this. I am disappointed that the maximum weight of traffic that can be sent to the Staging distribution is 15%. However, I am not yet seeing any traffic going through to the Staging distribution, so I am not sure how useful this is for a canary deployment.

There are some limitations with the CD feature, it seems. This documentation article mentions that during times of high utilisation of CloudFront itself (rather than traffic destined for your site specifically), all requests may get sent to the production distribution: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/continuous-deployment-quotas-considerations.html#all-requests-to-primary-distribution

I set up my CF distributions again in case I had made a mistake. What I get now is the Primary returned the first time I visit the site, and then on refresh the dreaded ERR_SSL_VERSION_OR_CIPHER_MISMATCH error. I am using a wildcard SSL certificate for the distributions, and a subdomain registered as a CNAME record in Route53.

Are you using a certificate issued by AWS Certificate Manager (ACM) or an imported one issued by an external certificate issuer, such as DigiCert? To keep users locked to the distribution they got sent to initially, you could configure session stickiness: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-continuous-deployment.html#understanding-continuous-deployment-sessions

Specifically, each DNS name has to belong to at most 1 CloudFront distribution at a time. Otherwise, when any random CloudFront edge location received a request for the name, it'd have no way of knowing which of the multiple distributions should process it. That's why it's logically impossible to spread a single name across multiple distributions and achieve controlled behaviour (like weighted routing).

Thanks, that is slightly helpful although not the answer.

I essentially do have an A/B testing scenario where I want to roll-out a new version of my app to users who will be acessing it largely from a link on my homepage. I want to weight traffic initially so that only a small percentage see the new app.

How this differs from all of the examples I have seen using CloudFront distributions is that I am dealing with a wholly new app - hosted in its own S3 bucket - not just variants on the same site like images or even data layer variance.

I just want to route a percentage of traffic from an arbitrary URL to one subdomain and a percentage to another.

So this is the code I am using to implement a redirect in my PoC and it does seem to be working. I have this as a CloudFront Function:

function handler(event) {
    var request = event.request;
    var headers = request.headers;
    let response = {};
    
    var url = Math.random() < 0.2 ? 'https://new.sandbox.mydomain.com/' : 'https://classic.sandbox.mydomain.com/';

    response = {
        statusCode: 302,
        statusDescription: 'Found',
        headers:
            { "location": { "value": url } }
        }
    console.log(`Redirecting to ${url}`);
    return response;
}

Not sure if there's a cleaner way to do it but seems to be working. I'm just setting up some logging now to monitor the traffic here.