How to properly link Heroku, CloudFront, Route53 with a custom SSL?

1
votes

I'm trying to set up a Web Application hosted on Heroku. DNS routing is done through AWS Route53 and distribution through CloudFront. I have purchased my own SSL cert for, let's say, www.example.com.

It's all working except that I want to be able to use subdomains and then show a different app within Heroku. This also works locally. However, if I whitelist the host headers in CloudFront so that I can do this routing, Heroku will redirect to an unknown application.

AWS says it's a misconfiguration on Heroku's end and Heroku states that I have misconfigured the DNS routing and need to apply the generated CNAME to Route53. But that CNAME routes to CloudFront.

So the setup right now is:

Heroku

Hosting Web App. Automatic Certificate Management is enabled. No domain added.

heroku config

Route53

CNAME points to CloudFront dist. As well as A and AAAA. Also for * wildcard

Route53 config

CloudFront

Origin points to Heroku deployment. Has CNAMES for the custom domain URLs like *.example.com

CloudFront dist config Origin config

My own custom SSL with * wildcard support was uploaded to AWS CM and added to CloudFront. It works, but I can imagine I've misconfigured this at some step.

How come if I send a host header that my Heroku deploy redirects to the wrong app?

1
herokudnsamazon-cloudfrontamazon-route53
Please post the relevant configuration of each service. – Thomas Timbul
@ThomasTimbul I didnt actually want to post any of the configuration details on a public forum. Any suggestions? – Kevin Toet
Can it be done by changing confidential information, such as domain names, etc? Or an image where you blank things out? Usually the easiest way to spot misconfiguration is by proof-reading it.... – Thomas Timbul
Possible duplicate of AWS Cloudfront as CDN for Heroku Site with Custom Domain – Thomas Timbul
@ThomasTimbul not a duplicate as this uses an S3 Bucket and not an origin outside of AWS. I'll make some screen shots of the config – Kevin Toet

1 Answers

1
votes

After communicating with Heroku and linking this post. It was made clear to me that Heroku and Route56/CloudFront have a special relationship and do not require the CNAME reference created by Heroku to be added to the AWS and the validation by Heroku can be neglected.

Running the following in the CLI worked and Host headers are not received and no redirect on Heroku's side occurs.

heroku domains:add example.com -a heroku-app-name
heroku domains:add *.example.com -a heroku-app-name