AI in Production

For the people not use route53 like me but Cloudflare as domain provider, CloudFront has a convenient 3-step flow for this:

1. CloudFront -> Distributions -> Add domain

Open your distribution, choose Add domain and enter the domain you want to use, for example:

www.your-domain.com

CloudFront then walks you through:

Step 1: Configure domains
Step 2: Get TLS certificate
Step 3: Review changes

2. Configure domains

Add your custom domain:

www.your-domain.com

CloudFront will associate this hostname with the distribution.

3. Get TLS certificate

Choose to create or use an ACM certificate.

For CloudFront, the certificate must be in:

us-east-1 (N. Virginia)

Even if your AWS application itself is running in a region like us-west-1.

CloudFront will give you a DNS validation CNAME record. Go to:

Cloudflare -> DNS -> Records

and add that CNAME as DNS only, not proxied.

After adding the validation record in Cloudflare, ACM may remain on "Pending validation" for a minute or two. That's normal. Just wait for it to become:

Issued

4. Review changes

Once the certificate is validated, review the configuration and apply the changes to the CloudFront distribution.

5. Point Cloudflare to CloudFront

In Cloudflare DNS, create:

Type: CNAME
Name: www
Target: xxx.cloudfront.net
Proxy: DNS only

For the root domain:

Type: CNAME
Name: @
Target: xxx.cloudfront.net
Proxy: DNS only

6. Enable HTTPS

In:

CloudFront -> Distribution -> Behaviors -> Edit

set Viewer protocol policy to:

HTTPS only

or, for a normal public website:

Redirect HTTP to HTTPS

Final flow:

www.your-domain.com
      |
      v
Cloudflare DNS
      |
      v
CloudFront + ACM TLS
      |
      v
AWS origin