Amplify custom domain fails with CloudFront alias conflict although authoritative DNS points to current Amplify target

Question

We are trying to associate portal.biteq.ai with an AWS Amplify Hosting app, but the domain association repeatedly fails with:

“One or more aliases specified for the distribution includes an incorrectly configured DNS record that points to another CloudFront distribution.”

Current Amplify state:

domainName: biteq.ai
enableAutoSubDomain: false
domainStatus: FAILED
subdomain: portal
branch: main
verified: true
dnsRecord: portal CNAME d2xvzimskxbvgx.cloudfront.net

We verified DNS directly against both authoritative Cloudflare nameservers:

portal.biteq.ai CNAME d2xvzimskxbvgx.cloudfront.net

Additional checks completed:

portal.biteq.ai is DNS-only and not Cloudflare-proxied.
Both authoritative nameservers return the same literal CNAME.
There is no wildcard *.biteq.ai record.
A random nonexistent subdomain does not resolve.
Amplify reports portal as verified: true.
The Amplify association contains only portal; there are no apex, www, or wildcard mappings.
enableAutoSubDomain is false.
No customer-visible CloudFront distributions related to this domain exist in our account.

Previous Amplify domain-association attempts generated these CloudFront endpoints:

d3i55rden6us8r.cloudfront.net
dwsh8wrfr0kye.cloudfront.net

The current association uses:

d2xvzimskxbvgx.cloudfront.net

At this point, authoritative DNS points exactly to the current Amplify-provided CloudFront hostname, yet CloudFront still reports that the alias points to another distribution.

This may indicate stale or conflicting Amplify-managed CloudFront domain-association state that is not visible or editable from the customer account.

How can we identify and clear the CloudFront distribution, distribution tenant, or domain association that AWS currently considers conflicting with portal.biteq.ai when the underlying Amplify-managed CloudFront resources are not visible in our account?

Similar AWS re:Post cases suggest this can require AWS-side cleanup of stale or orphaned Amplify-managed CloudFront aliases.

The remaining question is: what is the supported remediation path for a customer on Basic Support when the conflicting CloudFront resource is AWS/Amplify-managed and cannot be accessed or modified by the customer?

We have stopped deleting and recreating the domain association to avoid creating additional stale resources.

Sridhar · Answer

Thank you! I appreciate you sharing your experience with a similar issue. I did try to open an AWS support case, but backed off when I saw that technical support requires a paid support plan. Knowing that you were able to get AWS support involved in the past, I’ll give that route another try.

Sridhar

answered a month ago

Riku_Kobayashi · Answer

Hello.

Although it wasn't with Amplify, I once resolved a similar error on CloudFront by contacting AWS Support.  
Since support for account and billing issues is available free of charge, I recommend opening a case there first.  
https://console.aws.amazon.com/support

Sridhar · Answer

Problem: Amplify Hosting custom domain stuck at FAILED with "an incorrectly configured DNS record that points to another CloudFront distribution", even after the DNS record was corrected.

Cause: Amplify only checks DNS when the domain association is created, and never re-checks. Each recreate issues a new CloudFront target, so the record was always one address behind.

Fix, in this order: delete the subdomain's CNAME (keep the ACM validation CNAME) → delete and recreate the domain association → wait for status AWAITING_APP_CNAME and read the new target → only then add the CNAME, with proxying off. Live in about 7 minutes.

Note: an in-place retry is refused ("certificate verification was not successful"), so delete-and-recreate is the only path.

Amplify custom domain fails with CloudFront alias conflict although authoritative DNS points to current Amplify target

Add your answer

Relevant content