I have an existing multi-tenant website denoted by subdomain e.g. "abc.site.com" is for customer ABC and "xyz.site.com" is for customer XYZ. This is currently running in ElasticBeanstalk as a Python-Flask app. In addition to "abc.site.com", customers also have a qa environment "abc-qa.site.com" which is run in a separate ElasticBeanstalk. New code comes to the qa environment before going to production.

There is a section of the app that we want to decouple. I was able to create a CloudFront Distribution where it has multiple origins based on the path:

• Default origin goes to original ElasticBeanstalk app (this handles the API calls to retrieve data)
• Path origin (/newpath/*) goes to a S3 bucket to serve as a static site

This is great. No CORS configuration needed and I'm able to keep the subdomain pattern "abc-qa.site.com" where the old site runs as it should and the new site loads up CloudFront based on the path. However, I have run into a dilemma where I cannot add a new CloudFront distribution for production. I am applying an SSL cert which requires CNAME, so I enter in "*.site.com" but get a CNAME already in use exception. *-qa.site.com does not work because the wildcard can't have characters around it. I've read article and already followed the instructions.

Besides contacting AWS Support, is there any other way around this or another approach I should consider? Currently waiting on their reply and it got me thinking if this is the path I should be taking. I'm still new to the AWS cloud infrastructure and would like to get others' opinion on possible alternatives.

Thanks for your replies in advanced!