This reminds me of the awful Cloudfront vulnerability where any jerk can park your domain names in Cloudfront with no verification. One day you'll put one of yo

This reminds me of the awful Cloudfront vulnerability where any jerk can park your domain names in Cloudfront with no verification. One day you'll put one of your domains behind Cloudfront and suddenly they own your website. Scenario: 1. Today your DNS records look like this because you aren't using Cloudfront: site.com -- A --> 1.2.3.4 www.site.com -- CNAME --> site.com 2. Some jerk with an AWS account registers "www.site.com" in Cloudfront. 3. Tomorrow you create a cloudfront distribution for site.com and change site.com to a CNAME to "d12345abcdef.cloudfront.net". Instantly you're owned on WWW.site.com because it indirectly points to Cloudfront and you forgot to register that alias in AWS. Oh and guess what? The jerk can issue SSL certs for your domain name through Lets Encrypt because all they need to do is put a well-known file off your domain. 4. You have a bug bounty program (right?!) and pay quick, big money out to some researcher who is, thankfully, not a jerk. Good times.