30

I am trying to assign an own domain name to a user pool for Cognito and facing an issue that it seems that an A Record is required.

In my case i have registered wildcard on my internet domain and am trying to follow the steps as mentioned in https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html

Now i can create an A Record but have no clue where this A Record should point to. Any hints or tips are welcome :) It would be nice if this can be done without using CloudFront.

I tried CNAME's etc but as stated an A Record is required.

1
  • I ran into the same problem. And I added A record to point to ANY custom IP address and it works now.
    – dubucha
    Aug 18, 2020 at 7:33

9 Answers 9

38

It isn't the domain root that is relevant here. It's the subdomain that sits at the level below the one you enter. AWS refers to this as the parent domain. If you don't have an A record for the parent domain, AWS recommends you create a dummy A record.

  • If you enter auth.example.com, you need an A record for example.com
  • If you enter auth.qa.example.com, you need an A record for qa.example.com
  • If you enter foo.bar.qa.example.com you need an A record for bar.qa.example.com
2
  • 2
    The relevant point of concern here is that if you don't have a site (for example.com), but you do want to use auth.example.com as the auth domain, then what do you point your example.com A-Record to? Jul 30, 2021 at 21:19
  • 1
    @StevenEvers ran into this problem but lucky enough I'm able to point my root to a random A record. No idea why that needed to be the case. So I had dev.example.com and needed auth.dev.example.com, I had to point dev.example.com to somewhere. So I just pointed it to the same record as example.com. Nov 22, 2021 at 13:06
15

A web domain that you own. Its root must have a valid A record in DNS.

In simplified terms, if your domain is example.com then the root -- example.com -- needs to actually be configured for a web site before you continue. The specific value of the A record is not relevant to Cognito, since that would depend on how you choose to set up the site... but Cognito requires it to be there.

6
  • 5
    Why is this a requirement? My site is at www.mydomain.com so this is awkward. Why not just let people set up a custom domain without a website at the root? Nov 6, 2018 at 22:17
  • @MattGibson nobody said you need a web site with content at the root. What happens when you go to your domain without the www? If it's something sensible, it should work in this context. Nov 6, 2018 at 23:34
  • 3
    Well, I'm currently setting a redirect from mydomain.com to www.mydomain.com, so hopefully that will work. However I still don't understand the logic behind making it a requirement for the root domain in particular. I've set up Auth0 in the past and there was no need for this. Why do they require it if it's not used for anything? Nov 7, 2018 at 7:17
  • 1
    It's used for something -- some kind of validation -- it isn't clear just what, but presumably there is either some internal process that needs to see this or they are guarding against some kind of potential domain hijack vector that might exist when the domain configuration is not a common one. Nov 7, 2018 at 13:58
  • 2
    The A record doesn't really need to be connected to a resource that serves a website or anything like that. For my use case, The subdomain I wanted to use was e.g. auth.prod.example.com. I have other subdomains on prod.example.com, but nothing at the exact domain. I ran into this issue and just added an A record pointing to 127.0.0.1 and it got rid of the error.
    – djheru
    Feb 25, 2021 at 4:40
8

To deal with subdomains, I have created A record with IP 127.0.0.1 and it's working.

I wanted to add auth.dev.${domain_name}.com as a custom domain in cognito but I don't have pointing to any website for dev.${domain_name}.com so created A record for dev.${domain_name}.com and pointed to 127.0.0.1 ip address.

Reference

1
  • Excellent inspiration for my own answer. Nov 12, 2020 at 1:35
5

It seems that trying to use a subdomain with too many dots causes this error.

This works:

auth.example.com

This does not:

dev.auth.example.com

Also if you remove and re-add the same domain name this seems to cause an error. Changing to a different domain works.

I added a request to fix this to the #awswishlist https://awswishlist.com/

2
  • 1
    Heh, amusingly that's exactly the subdomain I was trying to use. :)
    – D. Patrick
    Jun 5, 2019 at 14:58
  • I have this flipped. I have dev.example.com and everything under *.dev.example.com is a replication of *.example.com. All dev records are in its own hosted zone in another account Nov 22, 2021 at 13:09
5

The popular answer correctly answers the question. But at a higher level there's still more to it. There is a cycle in the configuration dependencies:

Cognito requires the auth.example.com A record, which requires the example.com A record. The example.com A record needs a website to point to, and the website needs Cognito.

To break this cycle,

  1. Create a new Route 53 zone auth.example.com for Cognito to use independently from the website's example.com zone. This breaks the dependency cycle.
  2. Create an auth.example.com A record pointing to a placeholder IP address like 127.0.0.1. This will never actually be used.
  3. Now you can create an A record like dev.auth.example.com, stage.auth.example.com or prod.auth.example.com for each environment's Cognito custom domain.

The following Terraform example puts this all together, creating a Cognito custom domain prod.auth.example.com:

# Pre-existing hosted zone created by Route53 Registrar
data "aws_route53_zone" "main" {
  name = "example.com"
}

# Create a new Route 53 zone auth.example.com
#
# Actually, Route 53 zone creation belongs in a separate Terraform
# module where it can be shared by multiple environments.

resource "aws_route53_zone" "auth" {
  name = "auth.example.com"
}

resource "aws_route53_record" "auth-ns" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "auth.example.com"
  type    = "NS"
  ttl     = "30"
  records = aws_route53_zone.auth.name_servers
} As it is now,
# `terraform destroy` will destroy zone auth.example.com, leaving the other environments in the lurch.

# Only the name servers in the auth.example.com zone NS record know where
# to find auth.example.com. Add NS record in example.com pointing to the
# auth.example.com zone name servers. Now auth.example.com can
# be found through example.com.
resource "aws_route53_record" "auth-a" {
  zone_id = aws_route53_zone.auth.zone_id
  name    = "auth.example.com"
  type    = "A"
  ttl     = 300
  records = ["127.0.0.1"]  # Placeholder that is never used
}

# Route 53 zone auth.example.com setup done

module "acm" {
  source = "terraform-aws-modules/acm/aws"

  domain_name               = "prod.auth.example.com"
  zone_id                   = aws_route53_zone.auth.zone_id
  subject_alternative_names = []
  wait_for_validation       = true
}

resource "aws_cognito_user_pool" "this" {
  name = "prod-cognito"
}

resource "aws_cognito_user_pool_domain" "this" {
  depends_on      = [aws_route53_record.auth-a]
  domain          = "prod.auth.example.com"
  certificate_arn = module.acm.this_acm_certificate_arn
  user_pool_id    = aws_cognito_user_pool.this.id
}

resource "aws_route53_record" "subdomain-a" {
  zone_id = aws_route53_zone.auth.zone_id
  name    = "prod.auth.example.com"
  type    = "A"
  alias {
    evaluate_target_health = false
    name                   = aws_cognito_user_pool_domain.this.cloudfront_distribution_arn
    # Every CloudFront distribution's zone ID is Z2FDTNDATAQYW2
    zone_id = "Z2FDTNDATAQYW2"
  }
}

A bit of work remains: you also need to create application client(s) using aws_cognito_user_pool_client. I left this out because app clients are unrelated to the custom domain.

Update: I have since found I can get better isolation between environments by creating a hosted zone for each environment, like dev-auth.example.com, stage-auth.example.com and auth.example.com. There is no need to bother with further sub-subdomains below these.

1

I was using

authdev.mycompany.com

and had to create an A record(using the elastic ip) in the root domain which is

mycompany.com.

enter image description here

0

I understand that you're using Cognito Hosted UI for authentication and you need a custom domain.

When you create a custom domain for cognito, it will return an Alias target (which points to a cloudfront distribution).

Then take the following steps depending if you're using Route53 or DNS configuration:

DNS configuration

  1. have your DNS service provider add the alias target from the previous step as an alias for your user pool custom domain.
  2. Your DNS provider will also need to set up the subdomain for your custom domain.

Route53

  1. Sign in to the Route 53 console. You might be prompted for your AWS credentials.

  2. If you don't have a hosted zone in Route 53, set one up. Otherwise, skip this step.

    • a. Choose Create Hosted Zone.
    • b. Choose your custom domain from the Domain Name list.
    • c. For Comment, type an optional comment about the hosted zone.
    • d. Choose Create.
  3. On the Hosted Zones page, choose the name of your hosted zone.

  4. Choose Create Record Set.

  5. Select Yes for the Alias option.

  6. Type the alias target name that you noted in a previous step into Alias Target.

  7. Choose Create.

  8. Add a subdomain in Route 53 by using the alias target.

    • a. On the Hosted Zones page, choose the name of your hosted zone.
    • b. Choose Create Record Set and enter the following values:
      • i. For Name, type your preferred subdomain name. For example, if the subdomain you’re attempting to create is auth.example.com, type auth.
      • ii. For Type, choose A - IPv4 address.
      • iii. Select Yes for the Alias option.
      • iv. Type the alias target name that you noted in a previous step in Alias Target.
    • c. Choose Create.

Reference: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html

0

In my case I had already configured an A record for my root domain, the problem was that the Name servers of my Registered domain were different from the Name servers of the Hosted zone for that domain.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    May 10, 2022 at 19:33
0

1. If you are using route 53 then create a A type record. leave the subdomain blank. In place of IP value create a EC2 instance copy IPv4 public address and paste it there.

2. If you are using GoDaddy DNS then just use website builder and publish website. Your A record will be automatically created. Other option create a forwarding to random website(e.g. google.com, amazon.com) and after 5 min delete that. It also create a A record of parking. Third option jsut create A type record with name: @ and value: copy the IPv4 public adress of EC2 instance hit save button.Your A record is created.Same thing appied to other third party dns supplier.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.