Troubleshoot a Route 53 Domain Not Serving CloudFront

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListZonesAndDistributions",
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZonesByName",
        "cloudfront:ListDistributions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadZones",
      "Effect": "Allow",
      "Action": [
        "route53:GetHostedZone",
        "route53:ListResourceRecordSets"
      ],
      "Resource": "arn:aws:route53:::hostedzone/*"
    },
    {
      "Sid": "ReadCloudFrontCertificates",
      "Effect": "Allow",
      "Action": "acm:DescribeCertificate",
      "Resource": "arn:aws:acm:us-east-1:123456789012:certificate/*"
    }
  ]
}

// diagnose-route53-cloudfront.ts
// Walks the chain from registrar to origin for a domain served by CloudFront and prints
// PASS/FAIL for each link: NS delegation, the Route 53 record, the distribution's alternate
// domain names and status, the ACM certificate, and a live HTTPS request. Read-only.
// Usage: npx tsx diagnose-route53-cloudfront.ts www.example.com
import { Resolver } from "node:dns/promises";
import {
  Route53Client,
  ListHostedZonesByNameCommand,
  GetHostedZoneCommand,
  ListResourceRecordSetsCommand,
  type HostedZone,
} from "@aws-sdk/client-route-53";
import { CloudFrontClient, paginateListDistributions, type DistributionSummary } from "@aws-sdk/client-cloudfront";
import { ACMClient, DescribeCertificateCommand } from "@aws-sdk/client-acm";

const domain = process.argv[2]?.toLowerCase().replace(/\.$/, "");
if (!domain) throw new Error("Usage: diagnose-route53-cloudfront.ts <domain>");

const CLOUDFRONT_ZONE_ID = "Z2FDTNDATAQYW2";
const route53 = new Route53Client({ region: "us-east-1" });
const cloudfront = new CloudFrontClient({ region: "us-east-1" });
const acm = new ACMClient({ region: "us-east-1" });
const resolver = new Resolver();
resolver.setServers(["1.1.1.1", "8.8.8.8"]); // public resolvers, not your office or VPN DNS

const log = (ok: boolean, step: string, detail: string) => console.log(`${ok ? "PASS" : "FAIL"}  ${step.padEnd(26)} ${detail}`);
const strip = (name: string) => name.toLowerCase().replace(/\.$/, "");
const covers = (pattern: string, name: string) =>
  pattern === name || (pattern.startsWith("*.") && name.split(".").slice(1).join(".") === pattern.slice(2));

// The most specific public hosted zone that contains the domain.
async function findZone(): Promise<HostedZone | undefined> {
  const labels = domain.split(".");
  for (let i = 0; i < labels.length - 1; i++) {
    const candidate = labels.slice(i).join(".");
    const res = await route53.send(new ListHostedZonesByNameCommand({ DNSName: candidate, MaxItems: 5 }));
    const zone = res.HostedZones?.find((z) => strip(z.Name ?? "") === candidate && !z.Config?.PrivateZone);
    if (zone) return zone;
  }
  return undefined;
}

async function main(): Promise<void> {
  console.log(`Diagnosing ${domain}\n`);

  // 1. Delegation: the registrar's NS records must match the hosted zone's name servers.
  const zone = await findZone();
  if (!zone?.Id) return log(false, "Hosted zone", `no public hosted zone for ${domain} in this account`);
  const zoneName = strip(zone.Name!);
  const zoneId = zone.Id.replace("/hostedzone/", "");
  const { DelegationSet } = await route53.send(new GetHostedZoneCommand({ Id: zoneId }));
  const expected = (DelegationSet?.NameServers ?? []).map(strip).sort();
  const actual = (await resolver.resolveNs(zoneName).catch(() => [] as string[])).map(strip).sort();
  log(expected.join() === actual.join(), "NS delegation", `zone ${zoneId} expects [${expected.join(", ")}], public DNS has [${actual.join(", ") || "nothing"}]`);

  // 2. The record: an alias A/AAAA to CloudFront (or a CNAME, which can't be used at the apex).
  const rr = await route53.send(new ListResourceRecordSetsCommand({ HostedZoneId: zoneId, StartRecordName: domain, MaxItems: 10 }));
  const records = (rr.ResourceRecordSets ?? []).filter((r) => strip(r.Name ?? "") === domain && ["A", "AAAA", "CNAME"].includes(r.Type ?? ""));
  if (records.length === 0) return log(false, "Route 53 record", `no A, AAAA or CNAME record named ${domain}`);
  let target = "";
  for (const r of records) {
    if (r.AliasTarget) {
      const ok = r.AliasTarget.HostedZoneId === CLOUDFRONT_ZONE_ID && strip(r.AliasTarget.DNSName ?? "").endsWith(".cloudfront.net");
      log(ok, `Record ${r.Type}`, `alias -> ${r.AliasTarget.DNSName} (zone ${r.AliasTarget.HostedZoneId})`);
      if (ok) target = strip(r.AliasTarget.DNSName!);
    } else {
      const values = (r.ResourceRecords ?? []).map((v) => strip(v.Value ?? ""));
      const ok = r.Type === "CNAME" && values.some((v) => v.endsWith(".cloudfront.net"));
      log(ok, `Record ${r.Type}`, `${values.join(", ")} (TTL ${r.TTL}s)`);
      if (ok) target = values[0];
    }
  }
  const resolved = await resolver.resolve4(domain).catch((e: NodeJS.ErrnoException) => [`error ${e.code}`]);
  console.log(`      public DNS answer for ${domain}: ${resolved.join(", ")}`);
  if (!target) return log(false, "CloudFront target", "no record points at a *.cloudfront.net domain");

  // 3. The distribution the record points to.
  let dist: DistributionSummary | undefined;
  for await (const page of paginateListDistributions({ client: cloudfront }, {})) {
    dist = page.DistributionList?.Items?.find((d) => d.DomainName?.toLowerCase() === target) ?? dist;
  }
  if (!dist) return log(false, "Distribution", `${target} isn't a distribution in this account`);
  log(dist.Enabled === true, "Distribution enabled", `${dist.Id} enabled=${dist.Enabled}`);
  log(dist.Status === "Deployed", "Distribution status", `${dist.Status}`);
  const aliases = (dist.Aliases?.Items ?? []).map((a) => a.toLowerCase());
  log(aliases.includes(domain), "Alternate domain names", `[${aliases.join(", ")}]`);

  // 4. The certificate: ACM, us-east-1, issued, covering this exact name.
  const certArn = dist.ViewerCertificate?.ACMCertificateArn;
  if (!certArn) {
    log(false, "Certificate", "no ACM certificate; the default *.cloudfront.net cert can't serve a custom domain");
  } else if (!certArn.startsWith("arn:aws:acm:us-east-1:")) {
    log(false, "Certificate region", `${certArn} is not in us-east-1`);
  } else {
    const { Certificate: cert } = await acm.send(new DescribeCertificateCommand({ CertificateArn: certArn }));
    const names = (cert?.SubjectAlternativeNames ?? []).map((n) => n.toLowerCase());
    const valid = cert?.Status === "ISSUED" && (cert.NotAfter ?? new Date(0)) > new Date();
    log(valid, "Certificate status", `${cert?.Status}, expires ${cert?.NotAfter?.toISOString()}`);
    log(names.some((n) => covers(n, domain)), "Certificate covers name", `[${names.join(", ")}]`);
  }

  // 5. A real request through CloudFront.
  try {
    const res = await fetch(`https://${domain}/`, { redirect: "manual" });
    const detail = `${res.status} ${res.statusText}, x-cache: ${res.headers.get("x-cache") ?? "-"}, server: ${res.headers.get("server") ?? "-"}`;
    log(res.status < 400, "HTTPS request", detail + (res.status >= 300 && res.status < 400 ? ` -> ${res.headers.get("location")}` : ""));
  } catch (err) {
    const cause = (err as { cause?: { code?: string; message?: string } }).cause;
    log(false, "HTTPS request", `${cause?.code ?? ""} ${cause?.message ?? (err as Error).message}`.trim());
  }
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-route-53 @aws-sdk/client-cloudfront @aws-sdk/client-acm
npm install --save-dev tsx typescript

AWS_PROFILE=readonly npx tsx diagnose-route53-cloudfront.ts www.example.com
AWS_PROFILE=readonly npx tsx diagnose-route53-cloudfront.ts example.com

Diagnosing www.example.com

PASS  NS delegation              zone Z0123456789EXAMPLE expects [ns-1234.awsdns-26.org, ns-2012.awsdns-59.co.uk, ns-345.awsdns-43.com, ns-678.awsdns-20.net], public DNS has [ns-1234.awsdns-26.org, ns-2012.awsdns-59.co.uk, ns-345.awsdns-43.com, ns-678.awsdns-20.net]
PASS  Record A                   alias -> d111111abcdef8.cloudfront.net. (zone Z2FDTNDATAQYW2)
      public DNS answer for www.example.com: 18.160.10.21, 18.160.10.87, 18.160.10.112, 18.160.10.45
PASS  Distribution enabled       E1ABCDEF2GHIJK enabled=true
PASS  Distribution status        Deployed
FAIL  Alternate domain names     [example.com]
PASS  Certificate status         ISSUED, expires 2027-08-14T23:59:59.000Z
FAIL  Certificate covers name    [example.com]
FAIL  HTTPS request              ERR_TLS_CERT_ALTNAME_INVALID Hostname/IP does not match certificate's altnames: Host: www.example.com. is not in the cert's altnames: DNS:*.cloudfront.net