Set up DNS based URL forwarding in Amazon Route53

Question

I'm trying to setup forwarding in Amazon Route53. My last DNS service (Nettica) allowed me to route requests to "aws.example.com" to "https://myaccount.signin.aws.amazon.com/console/".

Is this functionality supported by Route53?

How does Nettica achieve this? Does it insert a special A, CNAME, PTR, or TXT record(s)?

Solution 1

I was running into the exact same problem that Saurav described, but I really needed to find a solution that did not require anything other than Route 53 and S3. I created a how-to guide for my blog detailing what I did.

Here is what I came up with.

---

Objective

Using only the tools available in Amazon S3 and Amazon Route 53, create a URL Redirect that automatically forwards http://url-redirect-example.vivekmchawla.com to the AWS Console sign-in page aliased to "MyAccount", located at https://myaccount.signin.aws.amazon.com/console/ .

This guide will teach you set up URL forwarding to any URL, not just ones from Amazon. You will learn how to set up forwarding to specific folders (like "/console" in my example), and how to change the protocol of the redirect from HTTP to HTTPS (or vice versa).

---

Step One: Create Your S3 Bucket

Open the S3 management console and click "Create Bucket".

---

Step Two: Name Your S3 Bucket

1. Choose a Bucket Name. This step is really important! You must name the bucket EXACTLY the same as the URL you want to set up for forwarding. For this guide, I'll use the name "url-redirect-example.vivekmchawla.com".

2. Select whatever region works best for you. If you don't know, keep the default.

3. Don't worry about setting up logging. Just click the "Create" button when you're ready.

---

Step 3: Enable Static Website Hosting and Specify Routing Rules

1. In the properties window, open the settings for "Static Website Hosting".
2. Select the option to "Enable website hosting".
3. Enter a value for the "Index Document". This object (document) will never be served by S3, and you never have to upload it. Just use any name you want.
4. Open the settings for "Edit Redirection Rules".

5. Paste the following XML snippet in it's entirety.

   <RoutingRules>
     <RoutingRule>
       <Redirect>
         <Protocol>https</Protocol>
         <HostName>myaccount.signin.aws.amazon.com</HostName>
         <ReplaceKeyPrefixWith>console/</ReplaceKeyPrefixWith>
         <HttpRedirectCode>301</HttpRedirectCode>
       </Redirect>
     </RoutingRule>
   </RoutingRules>
   

If you're curious about what the above XML is doing, visit the AWM Documentation for "Syntax for Specifying Routing Rules". A bonus technique (not covered here) is forwarding to specific pages at the destination host, for example http://redirect-destination.com/console/special-page.html. Read about the <ReplaceKeyWith> element if you need this functionality.

---

Step 4: Make Note of Your Redirect Bucket's "Endpoint"

Make note of the Static Website Hosting "endpoint" that Amazon automatically created for this bucket. You'll need this for later, so highlight the entire URL, then copy and paste it to notepad.

CAUTION! At this point you can actually click this link to check to see if your Redirection Rules were entered correctly, but be careful! Here's why...

Let's say you entered the wrong value inside the <Hostname> tags in your Redirection Rules. Maybe you accidentally typed myaccount.amazon.com, instead of myaccount.signin.aws.amazon.com. If you click the link to test the Endpoint URL, AWS will happily redirect your browser to the wrong address!

After noticing your mistake, you will probably edit the <Hostname> in your Redirection Rules to fix the error. Unfortunately, when you try to click the link again, you'll most likely end up being redirected back to the wrong address! Even though you fixed the <Hostname> entry, your browser is caching the previous (incorrect!) entry. This happens because we're using an HTTP 301 (permanent) redirect, which browsers like Chrome and Firefox will cache by default.

If you copy and paste the Endpoint URL to a different browser (or clear the cache in your current one), you'll get another chance to see if your updated <Hostname> entry is finally the correct one.

To be safe, if you want to test your Endpoint URL and Redirect Rules, you should open a private browsing session, like "Incognito Mode" in Chrome. Copy, paste, and test the Endpoint URL in Incognito Mode and anything cached will go away once you close the session.

---

Step 5: Open the Route53 Management Console and Go To the Record Sets for Your Hosted Zone (Domain Name)

1. Select the Hosted Zone (domain name) that you used when you created your bucket. Since I named my bucket "url-redirect-example.vivekmchawla.com", I'm going to select the vivekmchawla.com Hosted Zone.
2. Click on the "Go to Record Sets" button.

---

Step 6: Click the "Create Record Set" Button

Clicking "Create Record Set" will open up the Create Record Set window on the right side of the Route53 Management Console.

---

Step 7: Create a CNAME Record Set

1. In the Name field, enter the hostname portion of the URL that you used when naming your S3 bucket. The "hostname portion" of the URL is everything to the LEFT of your Hosted Zone's name. I named my S3 bucket "url-redirect-example.vivekmchawla.com", and my Hosted Zone is "vivekmchawla.com", so the hostname portion I need to enter is "url-redirect-example".

2. Select "CNAME - Canonical name" for the Type of this Record Set.

3. For the Value, paste in the Endpoint URL of the S3 bucket we created back in Step 3.

4. Click the "Create Record Set" button. Assuming there are no errors, you'll now be able to see a new CNAME record in your Hosted Zone's list of Record Sets.

---

Step 8: Test Your New URL Redirect

Open up a new browser tab and type in the URL that we just set up. For me, that's http://url-redirect-example.vivekmchawla.com. If everything worked right, you should be sent directly to an AWS sign-in page.

Because we used the myaccount.signin.aws.amazon.com alias as our redirect's destination URL, Amazon knows exactly which account we're trying to access, and takes us directly there. This can be very handy if you want to give a short, clean, branded AWS login link to employees or contractors.

---

Conclusions

I personally love the various AWS services, but if you've decided to migrate DNS management to Amazon Route 53, the lack of easy URL forwarding can be frustrating. I hope this guide helped make setting up URL forwarding for your Hosted Zones a bit easier.

If you'd like to learn more, please take a look at the following pages from the AWS Documentation site.

• Example: Setting Up a Static Website Using a Custom Domain
• Configure a Bucket for Website Hosting
• Creating a Domain that Uses Route 53
• Creating, Changing, and Deleting Resource Records

Cheers!

Solution 2

The AWS support pointed a simpler solution. It's basically the same idea proposed by @Vivek M. Chawla, with a more simple implementation.

AWS S3:

1. Create a Bucket named with your full domain, like aws.example.com
2. On the bucket properties, select Redirect all requests to another host name and enter your URL: https://myaccount.signin.aws.amazon.com/console/

AWS Route53:

1. Create a record set type A. Change Alias to Yes. Click on Alias Target field and select the S3 bucket you created in the previous step.

Reference: How to redirect domains using Amazon Web Services

AWS official documentation: Is there a way to redirect a domain to another domain using Amazon Route 53?

Solution 3

I was able to use nginx to handle the 301 redirect to the aws signin page.

Go to your nginx conf folder (in my case it's /etc/nginx/sites-available in which I create a symlink to /etc/nginx/sites-enabled for the enabled conf files).

Then add a redirect path

server {
  listen 80;
  server_name aws.example.com;
  return 301 https://myaccount.signin.aws.amazon.com/console;
}

If you are using nginx, you will most likely have additional server blocks (virtualhosts in apache terminology) to handle your zone apex (example.com) or however you have it setup. Make sure that you have one of them set to be your default server.

server {
  listen 80 default_server;
  server_name example.com;
  # rest of config ...
}

In Route 53, add an A record for aws.example.com and set the value to the same IP used for your zone apex.

Solution 4

Update

While my original answer below is still valid and might be helpful to understand the cause for DNS based URL forwarding not being available via Amazon Route 53 out of the box, I highly recommend checking out Vivek M. Chawla's utterly smart indirect solution via the meanwhile introduced Amazon S3 Support for Website Redirects and achieving a self contained server less and thus free solution within AWS only like so.

• Implementing an automated solution to generate such redirects is left as an exercise for the reader, but please pay tribute to Vivek's epic answer by publishing your solution ;)

---

Original Answer

Nettica must be running a custom redirection solution for this, here is the problem:

You could create a CNAME alias like aws.example.com for myaccount.signin.aws.amazon.com, however, DNS provides no official support for aliasing a subdirectory like console in this example.

• It's a pity that AWS doesn't appear to simply do this by default when hitting https://myaccount.signin.aws.amazon.com/ (I just tried), because it would solve you problem right away and make a lot of sense in the first place; besides, it should be pretty easy to configure on their end.

For that reason a few DNS providers have apparently implemented a custom solution to allow redirects to subdirectories; I venture the guess that they are basically facilitating a CNAME alias for a domain of their own and are redirecting again from there to the final destination via an immediate HTTP 3xx Redirection.

So to achieve the same result, you'd need to have a HTTP service running performing these redirects, which is not the simple solution one would hope for of course. Maybe/Hopefully someone can come up with a smarter approach still though.

Solution 5

If you're still having issues with the simple approach, creating an empty bucket then Redirect all requests to another host name under Static web hosting in properties via the console. Ensure that you have set 2 A records in route53, one for final-destination.com and one for redirect-to.final-destination.com. The settings for each of these will be identical, but the name will be different so it matches the names that you set for your buckets / URLs.

View more solutions

Comments

[Deiwin]

Creating a Cloudfront distribution with the URL as the origin also works. Just point the domain to the Cloudfront distribution from Route53 and make sure to configure TLS certs correctly.

[ejain]

CNAMEs are aliases, and don't redirect.

[maletor]

Even better would be to use an Alias record to point to the elastic load balancer in front of this machine.

[Steffen Opel]

@ejain - you are correct of course, I've fixed this accordingly (must have missed the notification back then); thanks for pointing out this potentially misleading phrasing!

[Steffen Opel]

+1 for this utterly smart solution - thanks much for taking the time to compile such an epic step by step guide, I've updated my answer to refer future readers to your's accordingly!

[Vivek M. Chawla]

Thanks, Steffen! I appreciate the feedback! This was my first-ever StackOverflow answer. You can imagine how surprised I was that, after writing all this, I couldn't even post it because I didn't have enough rep to post an answer with more than two images! Hehehe...ahh, memories. :-)

[JaredBroad]

Note:: For those wanting root domain redirects: example.org -> example.com -- do everything the same except use A Record with "Alias: Yes" enabled. Then select the bucket as the target.

[Greg]

Great solution. But I've run into a problem using https for the original URL. If the the bucket I'm re-directing is dev.example.com, the re-direct works great for http:// dev.example.com but fails for https:// dev.example.com. I haven't found a solution for this problem.

[Vivek M. Chawla]

@Greg I think that may have something to do with how Amazon handles HTTPS for S3. Unfortunately, when using a CNAME to access an S3 bucket, you can't force SSL by adding "https" because Amazon isn't hosting a certificate for "*.example.com". Since S3 won't allow the connection, we never get to the redirect logic. Unfortunately, I can't see a workaround to this.

[fredley]

Any idea why I'm getting a NoSuchBucket error?

[Vivek M. Chawla]

@TomMedley Did the fix that Michael suggested work for you? Let me know if there's anything I can still do to help.

[fredley]

@VivekM.Chawla It did, thanks!

[Barrett Kuethen]

Unfortunately, this doesn't seem to work if you're redirecting from the apex to a subdomain because you can't use a CNAME on the apex domain. Any thoughts? (apex meaning the naked domain)

[Vivek M. Chawla]

Sorry @BarrettKuethen, I can't think of how you would do this using only Amazon's native services, ie. without spinning up a host somewhere to point an A record to, and have that host do a redirect. If I can think of something, I'll ping you with another comment.

[Dan Milon]

There is a new option "Redirect all requests to another host name" under the bucker options. I put in there the IAM sign in url and it worked like a charm, no need for XML.

[Damien Justin Šutevski]

Can this be done with https yet/now?

[lu yuan]

Why "name the bucket EXACTLY the same as the URL you want to set up for forwarding" ?

[Slake]

Step 3.2: Forget about the "Enable website hosting" & directly go with select "Redirect all requests to another host name".

[Vivek M. Chawla]

@Slake I took a look and you're right, you can go directly with the "Redirect all Requests..." option. Having said that, I think that the answer as currently written gives readers an opportunity to learn about some extended features, so I prefer to keep this answer as-is. Thanks!

[Siphon]

@BarrettKuethen, you can still setup a cname (in step 7 here) using these steps for all apex domain traffic by using the wildcard character. (e.g. *.example.com) This will let you setup a DNS-only solution for redirecting an apex domain.

[Kamy D]

Any solution for HTTPS? Trying to point domain.com to domain.com. I get <Code>AccessDenied</Code> error

[Pierre Ozoux]

I think this solution is easier (a lot) stackoverflow.com/a/32991751/1703029 can you point to it please? Thanks!

[Costa Michailidis]

This fails with SSL. S3 doesn't have access to my SSL cert to perform the redirect, and I force all my traffic over SSL. Any advice?

[mlissner]

So you can totally do HTTPS now, if you set up a three tier system within AWS. Now, this is getting rather ridiculous for just doing redirections, but S3 buckets can do redirections as described above. If you want to do HTTP --> HTTPS redirections, you can actually do that using Amazon Cloudfront, which will use a free HTTPS certificate generated by Amazon Certificate Manager. The final system has Route 53 connecting to Cloud Front (which handles https traffic), connecting to S3, which does the redirection.

[mythofechelon]

This works great for HTTP but not HTTPS.

[Roberto Schneiders]

@mythofechelon What do you mean? I haven't had any problem with https so far. If you want to use https with your domain (ex: https:// aws.example.com), this is a completely different problem, because you will need a server with ssl certificate to be able to do that.

[Andy Hayden]

@mlissner it seems so elaborate for something that ought to be so simple.

[Mario Olivio Flores]

The official documentation is here: aws.amazon.com/premiumsupport/knowledge-center/…

[Roberto Schneiders]

Thank you @MarioOlivioFlores. I added the link to the official docs in my answer.

[Lorenz Lo Sauer]

I would not recommend it that way, as results are cached and update time takes a while, moreover only domains will be supported.

[Pawel]

I don't see my buckets in Route53. I can't select them from the list. How long does it take Route53 to see that there is a new bucket on my account?

[Roberto Schneiders]

@Pawel you should see the bucket right away. Make sure the bucket name is exaclty the same as the full route53 domain. For example, if you are creating an Alias A record with the name "mysubdomain", your bucket name should be "mysubdomain.domain.com".

[aidan]

Does this Redirect all requests to another host name option still exist? I can't see it when I go to bucket properties.

[Roberto Schneiders]

good question @aidan. Can you try to use the option "Redirect requests" under "Static website hosting" options?

[Douglas Figueroa]

This should be the correct answer, its better to reference components inside AWS using Alias for performance purposes instead of CNAME (that works but its not the best approach).

[poitroae]

50 steps for a simple URL to URL forwarding. That's insane, Amazon! @amazon

[blueprintchris]

wonderful. works with HTTPS.