Custom DNS for Cloudfront returns 403 - aws-cloudformation

Question

I am using Cloudformation to deploy resources. This includes a Cloudfront CDN and a RecordSet. I want this to create a new record set for a custom domain test.example.com, that will point to my Cloudfront CDN, which points to an S3 bucket. After successful deployment, I get the following error:
403 ERROR
The request could not be satisfied.
Bad request. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
Testing using the Cloudfront Domain is successful. When I check the AWS console, the only thing I notice is that the Alternate Domain Names (CNAMEs) is empty:
When I populate that with the expected value test.example.com, the page loads just fine.
I have tried adding Aliases: test.example.com to the Cloudfront DistributionConfig but then I get a circular error with the RecordSet.
How can I have both the CDN and the RecordSet in Cloudformation, with the Alternate Domain Names (CNAMEs) populated?
Cloudfront:
Distribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
Origins:
-
# Use the Website as the origin
DomainName: !GetAtt 'Website.DomainName'
Id: !Ref Website
S3OriginConfig:
OriginAccessIdentity: !Join [ '', [ 'origin-access-identity/cloudfront/', !Ref CloudFrontOriginAccessIdentity] ]
Enabled: true
HttpVersion: http2
DefaultRootObject: index.html
CustomErrorResponses:
- ErrorCode: 404
ResponseCode: 200
ResponsePagePath: /index.html
- ErrorCode: 403
ResponseCode: 200
ResponsePagePath: /index.html
DefaultCacheBehavior:
AllowedMethods:
- DELETE
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
DefaultTTL: 60
ForwardedValues:
QueryString: true
Cookies:
Forward: none
# The origin id defined above
TargetOriginId: !Ref Website
ViewerProtocolPolicy: "redirect-to-https" # we want to force https
# The certificate to use when using https
ViewerCertificate:
AcmCertificateArn: arn:aws:acm:us-east-1:<id>:certificate/<certId>
MinimumProtocolVersion: TLSv1
SslSupportMethod: sni-only
DNS:
DNS:
Type: AWS::Route53::RecordSetGroup
Properties:
HostedZoneId: <<id>>
RecordSets:
- Name: test.example.com
Type: A
AliasTarget:
HostedZoneId: Z2FDTNDATAQYW2
DNSName: !GetAtt
- Distribution
- DomainName

Answer 1

Looks like it is successful when I add the following to the Cloudfront distribution:
Aliases:
- test.example.com
My mistake is I was previously referencing the DNS:
Aliases: !Ref DNS
which was incorrect and causing my circular dependency issue