DNS
Point your console hostname at the stack's load balancer.
The console, the API and the Splunk add-on all use one hostname in your
domain: ConsoleHostname. The stack doesn't create a public DNS record; you do,
after the launch.
Create the record
Take the AlbDnsName output and point ConsoleHostname at it:
- Route 53: an alias
Arecord to the load balancer, or aCNAME. - Any other DNS provider: a
CNAMEfromConsoleHostnametoAlbDnsName. A zone apex (such asexample.com) can't hold aCNAME; there, use your provider'sALIAS/ANAMErecord or CNAME flattening, or pick a subdomain.
Which zone depends on AlbScheme:
AlbScheme | Record goes in |
|---|---|
internet-facing | Your public zone. |
internal | A zone your network resolves privately. If it's a Route 53 private hosted zone, set PrivateHostedZoneId and the stack creates the alias record for you. |
Once the record resolves, https://<ConsoleHostname>/readyz returns 200. Plain
HTTP on port 80 redirects to HTTPS.
What's bound to the hostname
- The certificate.
CertificateArnmust coverConsoleHostnameand be issued in the stack's Region. - Sign-in. The Cognito app client allows only
https://<ConsoleHostname>/auth/callbackas its callback andhttps://<ConsoleHostname>/as its sign-out URL. - The Splunk add-on and API clients, which call the console hostname.
Your identity provider is configured with the Cognito URLs from the stack outputs, not with the console hostname, so it's unaffected by a hostname change.
Change the hostname
Update the stack with the new ConsoleHostname and a CertificateArn that
covers it, leaving every other parameter at its previous value. The same update
changes the Cognito callback URLs and rolls the server onto the new name; it
runs no database transition. Then move the DNS record, and repoint anything
that calls the old name, such as the Splunk add-on.
Hostnames operated by Tracemill, and a relay for consoles that aren't reachable from the internet, aren't available yet. Today the console is always on a hostname in your own domain.