Question: How do I resolve the CNAMEAlreadyExists error when I set up a CNAME alias for my CloudFront distribution?

When I set up a Canonical Name record (CNAME) alias for my Amazon CloudFront distribution, I get a "CNAMEAlreadyExists" error.

Short descriptionYou can't use the same CNAME alias for more than one CloudFront distribution. When the CNAME alias that you're trying to add is already associated with another CloudFront distribution, you receive an error:"One or more of the CNAMEs you provided are already associated with a different resource. (Service: AmazonCloudFront; Status Code: 409; Error Code: CNAMEAlreadyExists; Request ID: a123456b-c78d-90e1-23f4-gh5i67890jkl*"If you have access to both source and target distributions, then manually remove the CNAME association from the existing CloudFront distribution. Then, associate the CNAME with the new CloudFront distribution.Note: If you want to manually associate the CNAME, then you might need to wait until the old distribution's status is Deployed before you proceed.If you don't know the distribution ID, then use the ListConflictingAliases CloudFront API. This allows you to find partial information about the distribution and the account ID for the conflicting CNAME alias. Then, use AssociateAlias API to move your CNAME from the existing distribution (source distribution) to the new distribution (target distribution). Use one of the following resolutions based on your scenario:For source and target distributions that are in the same account, refer to the Use the AssociateAlias API to move your CNAME section.For cross-account source and target distributions, refer to the Deactivate source distribution with the conflicting CNAME section.If you can't deactivate the source distribution because of downtime to existing traffic, then refer to Use a wildcard to move the alternate domain name.Note: You can't use a wildcard to move an apex domain (example.com). To move an apex domain when the source and target distributions are in different AWS accounts, contact AWS Support to move an alternate domain name.

ResolutionUse the AssociateAlias API to move your CNAMENote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.1.    In the AWS Identity and Access Management (IAM) policy of the user or role that's making the API request, add the following resource-level permissions:Important: The IAM user or role that makes the request must have these resource-level permissions in both the source distribution and target distribution.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "CloudFrontCnameSwapSameAcc",      "Effect": "Allow",      "Action": [        "cloudfront:GetDistribution",        "cloudfront:ListConflictingAliases",        "cloudfront:AssociateAlias",        "cloudfront:UpdateDistribution"      ],      "Resource": [        "arn:aws:cloudfront::SourceAcccount:distribution/SourceDistroID",        "arn:aws:cloudfront::TargetAccount:distribution/TargetDistroID"      ]    }  ]}Note: Replace SourceAcccount with the AWS account number of the source distribution. Replace SourceDistroID with the source distribution ID. Replace TargetAccountID with the AWS account number of the target distribution. Replace TargetDistroID with target distribution ID.2.    Identify the distribution with the conflicting CNAME. If you don't know which distribution has the conflicting CNAME, then use the ListConflictingAliases API to find that distribution:$ aws cloudfront list-conflicting-aliases --distribution-id YourDistributionID --alias YourCNAMENote: Replace YourDistributionID with the ID of your distribution. Replace YourCNAME with the conflicting CNAME alias.3.    To verify ownership of the domain, you must have read access to YourDistributionID. You must also have an SSL certificate associated with the CloudFront distribution that secures the conflicting CNAME.When you're ready to verify ownership, create a DNS TXT record for the CNAME that resolves to the target distribution's canonical name. Your TXT record must include an underscore before the CNAME, Apex, or Wildcard:_.example.com.         900   IN   TXT     "dexample123456.cloudfront.net"_cname.example.com.    900   IN   TXT     "dexample123456.cloudfront.net"_*.example.com.        900   IN   TXT     "dexample123456.cloudfront.net"4.    Verify that the target distribution has a valid SSL certificate.Note: The subject name or subject alternative name must match or overlap with the given CNAME alias. It's a best practice to have a valid certificate issued from a trusted CA that's listed in Mozilla's CA certificate list or AWS Certificate Manager.5.    Run the AssociateAlias API request from the account that owns the target distribution:$ aws cloudfront associate-alias --target-distribution-id YourTargeDistributiontID --alias your_cname.example.comDeactivate the source distribution with the conflicting CNAMEIf your source distribution and target distribution are in different AWS accounts, then first disable the source distribution that's associated with the conflicting domain. Then, use the AssociateAlias API to move the CNAME.You can use the associate-alias command to move Apex domains between different AWS accounts1.    Open the CloudFront console.2.    On the navigation pane, choose Distributions3.    Select the source distribution, and then choose Disable.If you don't know which distribution has the conflicting CNAME, then use the ListConflictingAliases API to find that distribution. Replace YourDistributionID with the ID of your distribution and YourCNAME with the name of the conflicting CNAME:$ aws cloudfront list-conflicting-aliases --distribution-id YourDistributionID --alias YourCNAMENote: The ListConflictingAliases API requires the GetDistribution and ListConflictingAliases permissions.After you deactivate the source distribution, follow the steps in the Use the AssociateAlias API to move your CNAME section.If you don't have access to the AWS account with the source distribution, or if you can't deactivate the source distribution, then contact AWS Support.Use a wildcard to move the alternate domain nameIf your source distribution and target distribution are in different accounts but you can't deactivate the source distribution, then move the CNAME. To do this, use a wildcard. You must have access to both the source distribution and target distribution for this process.This process involves multiple updates to both source and target distributions. Wait for each distribution to fully deploy the latest change before you proceed to the next step.1.    Update the target distribution to add a wildcard CNAME that covers the alternate domain name that you want to move. If your domain is www.example.com, then add the wildcard alternate domain name *.example.com to the target distribution.Note: You must have an SSL/TLS certificate on the target distribution that secures the wildcard domain name2.    Update the DNS settings for the CNAME to point to the target distribution's canonical name. For example, if your domain is www.example.com, then update the DNS record for www.example.com to route traffic to the target distribution's canonical name:www.example.com.         86400   IN   CNAME     "dexample123456.cloudfront.net"Note: Even after you update the DNS settings, the source distribution serves requests that use the alternate domain name. This is because the alternate domain name is still associated to the source distribution.3.    Update the source distribution to remove the alternate domain name.Note: During this step, there's no interruption to the live traffic. Because the requested domain name matches the wildcard domain that's added to the target distribution, live traffic uses the target distribution settings.4.    To add the alternate domain name that you want to move, update the target distribution.5.    To validate the DNS record for the CNAME, use dig or a similar DNS query tool:dig CNAME www.example.com +shortnslookup example.com6.    (Optional) To remove the wildcard alternate domain name, update the target distribution.