Static-IP Options Compared

Three ways to solve "apex domain needs a fixed target, ALB doesn't have one."

1. Route 53 ALIAS record (best, if applicable)

Points the apex directly at the ALB's DNS name — no static IP needed at all, because Route 53 resolves the Alias server-side rather than via CNAME.
Cost: free.
Catch: only works if the domain's DNS zone is hosted in Route 53. If a client keeps DNS elsewhere (GoDaddy, Cloudflare, local registrar), this isn't available.
Removes the shared-server risk entirely for that domain — no vhost, no Let's Encrypt renewal, no fallthrough possible.

Provisions 2 fixed Anycast IPs that sit in front of the ALB. The apex A record points at these IPs directly.
Routing/SSL then goes through the ALB's own listener rules and ACM cert — the same mechanism already used safely for subdomains — instead of a hand-maintained Apache config.
Default listener rule can return a fixed 404/403, so an unmapped domain fails safely instead of leaking to another client.
Cost: ~$0.025/hr fixed per accelerator (~$18/month) + a Data Transfer-Premium fee (~$0.01–$0.105/GB depending on source region/edge location) + standard public IPv4 charges. Adds up across many low-traffic redirect domains.
Works regardless of who hosts the client's DNS.

One small EC2 instance with a static IP, hosting Apache vhosts + Let's Encrypt certs for every client's apex domain.
Cost: cheapest option (~$3–5/month total, shared across all clients).
Risk: a shared, manually-edited config file is a single point of failure — a missing/incorrect vhost lets Apache's default-vhost behavior serve a different client's site. See Incident Postmortem.
Mitigated (not eliminated) by the catch-all vhost fix in Apache Config Templates.

Situation	Recommended option
Client's DNS is on Route 53	Alias record — free, structurally safest
Client's DNS is elsewhere, budget allows	Global Accelerator
Low-traffic client, cost-sensitive	Dedicated server, but with catch-all vhost + onboarding checklist