Amplify domain association stuck on "alias points to another CloudFront distribution" after migrating a domain between apps.

I'm not an Amplify expert, but my understanding is: Amplify uses AWS-managed CloudFront distributions under the hood. Because you deleted the old app while the domain was still attached, the hidden distribution still holds your CNAMEs, preventing the new distribution from claiming them.

Since you cannot see or manage Amplify's hidden distributions, you must force-move the alias to a distribution you control using the AssociateAlias API. Here is how to fix it without a Support plan:

1. Get a Certificate: Request a free ACM certificate for your domain (example.com and [www.example.com](https://www.example.com)) in us-east-1 and validate it via Cloudflare.
2. Create a Dummy Distribution: Create a new standard CloudFront distribution in your own AWS account. You can use any dummy origin (like an empty S3 bucket).
3. Force-Grab the Alias: Use the AWS CLI to forcefully move the alias from the hidden Amplify distribution to your new one:

aws cloudfront associate-alias --target-distribution-id <YOUR_DUMMY_DIST_ID> --alias www.example.com

4. Clean Up: Once the alias is successfully attached to your dummy distribution, remove the alias from it and delete the dummy distribution.
5. Retry Amplify: The alias is now completely free. You can safely retry the Amplify domain association in ap-south-1.

see also: AWS re:Post Knowledge Center - How do I resolve the CNAMEAlreadyExists error in CloudFront?

You've encountered a known challenge when migrating Amplify apps with custom domains between regions. The core issue is that CloudFront distributions maintain exclusive ownership of alternate domain names (CNAMEs/aliases), and when domain associations fail or are deleted, there can be a delay before those aliases are fully released from the underlying distributions.

Regarding your specific questions:

1. Stale alias release timing: When an Amplify domain association is deleted, the underlying CloudFront distribution should be cleaned up, but this process is not instantaneous. The exact timing can vary, but it typically takes anywhere from several minutes to a few hours for the aliases to be fully released. In some cases, particularly with failed associations, the cleanup may not complete properly, leaving the aliases in a stuck state.

2. Identifying which distribution holds an alias: Since Amplify manages these CloudFront distributions on your behalf in AWS-owned infrastructure, they won't appear in your own CloudFront console or API responses. This makes it difficult to directly inspect which distribution currently claims your domain names. The distributions are created and managed in the background as part of the Amplify service.

3. Force-releasing stuck aliases: Unfortunately, there isn't a self-service mechanism to force-release aliases that are stuck on Amplify-managed distributions. This type of issue typically requires intervention from AWS Support to manually clear the alias associations from the backend.

For your immediate situation, here are some recommendations:

• Wait at least 24-48 hours from your last deletion attempt before trying again. This gives the backend systems time to fully clean up any lingering alias associations.

• When you do retry, ensure your DNS records are already pointing to the new distribution's CloudFront domain before initiating the domain association in Amplify. While Amplify only waits about 2 minutes in AWAITING_APP_CNAME state, having the DNS pre-configured can help.

• Consider temporarily using a different subdomain (like temp.example.com) to get your application back online while the alias issue resolves, then switch back to your primary domain once the cleanup completes.

• If you need faster resolution, you can open a support case through the AWS Support Center (https://console.aws.amazon.com/support/) to request manual intervention to clear the stuck aliases. Include the domain names, the new Amplify app ID, and the region in your case details.

The behavior you're seeing where each retry creates a new distribution with a new hostname is expected - Amplify creates a fresh CloudFront distribution for each domain association attempt. This is why it's important to wait for full cleanup before retrying, as multiple failed attempts can compound the issue.

Going forward, when migrating Amplify apps between regions, the recommended approach is to fully remove the domain association from the old app and wait for confirmation that it's completely deleted before attempting to add it to the new app. This avoids the alias conflict you've encountered.