Problem
Adding an alternate domain name fails with CNAMEAlreadyExists. Changing a DNS record alone does not remove an existing CloudFront domain association.
Diagnose the Conflict
For a standard distribution, the following read-only command can locate conflicts:
aws cloudfront list-conflicting-aliases \
--distribution-id YOUR_TARGET_DISTRIBUTION_ID \
--alias www.example.comThe target distribution must be in your account and have an attached certificate covering the alias. AWS partially masks account and distribution identifiers in the output.
This command covers standard distributions. Use AWS's ListDomainConflicts operation when your setup includes distribution tenants.
Fix
Determine who owns the source distribution and whether you control both sides. Follow AWS's supported alternate-domain move procedure for that ownership arrangement. Prepare the destination certificate and origin before moving traffic.
Do not delete a working distribution just to free its alias. Cross-account moves may require ownership verification, coordination, or AWS Support depending on the situation.
Verify
After the move, confirm the target distribution lists the alternate domain and that DNS points to the intended endpoint. Test HTTPS and a known asset, then check request logs to ensure traffic reaches the destination.
A cached DNS answer and a successful configuration update are different observations; verify both configuration and actual requests.