Day 5

# If domain is already registered elsewhere, create a hosted zone
aws route53 create-hosted-zone \
  --name myapp.com \
  --caller-reference $(date +%s)

# Get the nameservers to add at your registrar
aws route53 list-hosted-zones-by-name \
  --dns-name myapp.com \
  --query 'HostedZones[0].Id' --output text

# IMPORTANT: ACM certificates for CloudFront MUST be in us-east-1
aws acm request-certificate \
  --domain-name myapp.com \
  --subject-alternative-names "*.myapp.com" \
  --validation-method DNS \
  --region us-east-1

# Get the CNAME validation record
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123:certificate/abc \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'

{
  "Origins": {
    "Quantity": 1,
    "Items": [{
      "Id": "S3Origin",
      "DomainName": "myapp.s3-website-us-east-1.amazonaws.com",
      "CustomOriginConfig": {
        "HTTPPort": 80,
        "OriginProtocolPolicy": "http-only"
      }
    }]
  },
  "DefaultCacheBehavior": {
    "TargetOriginId": "S3Origin",
    "ViewerProtocolPolicy": "redirect-to-https",
    "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
    "Compress": true
  },
  "ViewerCertificate": {
    "ACMCertificateArn": "arn:aws:acm:us-east-1:123:certificate/abc",
    "SslSupportMethod": "sni-only",
    "MinimumProtocolVersion": "TLSv1.2_2021"
  },
  "Aliases": { "Quantity": 1, "Items": ["myapp.com"] },
  "Enabled": true,
  "HttpVersion": "http2"
}

{
  "Changes": [{
    "Action": "CREATE",
    "ResourceRecordSet": {
      "Name": "myapp.com",
      "Type": "A",
      "AliasTarget": {
        "HostedZoneId": "Z2FDTNDATAQYW2",
        "DNSName": "d1234abcde.cloudfront.net",
        "EvaluateTargetHealth": false
      }
    }
  }]
}