aws / aws/aws-cdk

route53: CloudFormation-Validate::E3029 false positive on HTTPS records alias for CloudFront distributions

Open
#38,407 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-route53 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

`CloudFormation-Validate::E3029` is reported on an HTTPS record with alias for CloudFront distribution.

Stack:

``` ts
declare const distribution: cloudfront.Distribution;
declare const zone: route53.HostedZone;
new route35.HttpsRecord(this, 'HTTPS', {
zone,
target: route53.RecordTarget.fromAlias(new route53_targets.CloudFrontTarget(distribution)),
});
```

> WARNING AliasTarget: AliasTarget cannot be used with record type 'HTTPS' (CloudFormation Validate)
> ... aws-cdk-lib.aws_route53.CfnRecordSet
> Acknowledge with 'CloudFormation-Validate::E3029'

But HTTPS records support alias for CloudFront distributions since Jul 1, 2025.
For details, see https://aws.amazon.com/blogs/networking-and-content-delivery/boost-application-performance-amazon-cloudfront-enables-https-record/

### Regression Issue

- [x] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

2.261.0

### Expected Behavior

No issues should be reported.

### Current Behavior

See above.

### Reproduction Steps

See above.

### Possible Solution

_No response_

### Additional Information/Context

HTTPS records support alias only for CloudFront distributions. Aliasing other resources, such as ALBs, should be still warned.

### AWS CDK Library version (aws-cdk-lib)

2.262.1

### AWS CDK CLI version

2.1133.0 (build 712d792)

### Node.js Version

v24.18.0

### OS

Linux

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the aws_route53 CfnRecordSet handling for the CloudFormation-Validate::E3029 warning and reproduce the issue with the TypeScript HTTPS alias example. Check the existing validation coverage for alias record types. Done means CloudFront HTTPS aliases no longer warn, while aliases to unsupported resources such as ALBs still do.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.