You can do this with Route 53, CloudFront, Amazon Certificate Manager, and S3.
Create an empty bucket in Amazon S3. Choose a region near the majority of your viewers. The bucket name does not matter.
Enable the web site hosting feature on the bucket. Note the web site endpoint hostname in the console. It will be in the general form of
Define the following routing rule for the bucket.
<ReplaceKeyWith></ReplaceKeyWith> <!-- remove this line to preserve the original path after redirect -->
Requests arriving at the endpoint hostname for the bucket will be redirected to
https://example.com. The path will not be preserved unless you remove the indicated line.
But you want other hostnames, specifically, most of
*.example.com. And HTTPS.
Create a wildcard certificate in Amazon Certificate Manager (ACM) in us-east-1 for
*.example.com. This needs to be us-east-1 regardless of the bucket region because we'll be using CloudFront and this is where CloudFront interconnects to ACM.
Create a new CloudFront distribution, using the new ACM certificate, using the bucket's web site endpoint hostname as a custom (not S3) origin server, and specifying
*.example.com as the distribution's alternate domain name (CloudFront also calls this a "CNAME" even though that is not what this is). Choose redirect all HTTP requests to HTTPS.
Take the distribution's assigned dzzzexample.cloudfront.net hostname and use it to create an A record (for
*.example.com, Alias = Yes) in Route 53 in the example.com hosted zone.
Wait for the distribution to go to the Deployed state.
Route 53 will respond to any
*.example.com query not matching an other existing (or future) record in the zone with IP addresses of the nearest CloudFront edge.
CloudFront will redirect HTTP to HTTPS and will use the ACM certificate. CloudFront will send all requests to the bucket (unless it happens to have cached a response to a prior identical request) and S3 will always return a redirect response because
<KeyPrefixEquals></KeyPrefixEquals> actually tells S3 to check whether the leftmost 0 characters in the requested object key is empty string, which it always will be, and redirect when that condition is true.
Assuming you're already using Route 53, the new recurring cost (assuming zero traffic) is $0. You'll be paying CloudFront per-request and bandwidth charges and S3 per-request charges, both of which should be negligible until you get into hundreds of thousands of requests.