DNS – Point Apex Domain to AWS Load Balancer

Alias record are not an actual DNS record type -- they are pointers to other records within Route 53, so the target of an Alias record can only be an S3 bucket, an Elastic Load Balancer, a CloudFront distribution, or another record of the same type (e.g., an A record) within your hosted zone. Route 53 uses its internal database to find the target and return a standard DNS response.

So it is not directly possible to point an Alias to an external destination.

If you really want to point an Alias at an external destination, it is indirectly possible using CloudFront, because CloudFront accepts a hostname (example.herokuapp.com) as the name of the Origin server where requests will be forwarded. It also allows you to use an SSL certificate generated by Amazon Certificate Manager, and to selectively route different path patterns to different destinations (such as routing /images/* to an S3 bucket, for example). The caching behavior of CloudFront can be customized or disabled, if you don't want it.

This will, of course, incur usage charges for requests and bandwidth, but provides some additional capabilities that might be worth it, including relieving load on your heroku service if caching is something you could benefit from.

There are, however, valid reasons for using the www hostname rather than the bare domain, and configuring the bare domain to redirect incoming requests to www, which can be done in a number of different ways.

Background - Route 53

You don't need to transfer your domain to AWS, but one thing that might help is to use the AWS Route53 DNS service. It has the concept of an "alias record". This record type acts like a CNAME and can work at the domain root. This is very useful when you're using AWS load balancers.

This won't solve your problem, exactly. You still need to have a valid certificate for the non-www domain, and you still need to issue a redirect. It might form part of a solution though.

R53 is pretty cheap - $0.50 per month, and $0.40 per million queries.

Solution - Certificate SAN

Another option is to have a certificate that includes both your www and non-www domain name. This is called an Subject Alternative Name (SAN) and is trivial to do. Let's Encrypt does these and they're free. This way you can have your EC2 server do the redirect https://example.com -> https://www.example.com

Putting it together

I suspect that using an alias record and changing your certificates you can have the load balancer or Cloudfront do your redirect for you. That saves the EC2 instance doing it, and is a bit faster.