diff --git a/terraform/imports.tf b/terraform/imports.tf
index 04b27e9..a055625 100644
--- a/terraform/imports.tf
+++ b/terraform/imports.tf
@@ -1,104 +1,9 @@
 import {
-  to = module.keycloak_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/id/A"
+  to = module.cdn_domain.hcloud_zone_rrset.cname
+  id = "2martens.de/cdn/CNAME"
 }
 
 import {
-  to = module.keycloak_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/id/AAAA"
-}
-
-import {
-  to = module.keycloak_domain.hcloud_zone_rrset.uberspace_domain_key[0]
-  id = "2martens.de/uberspace._domainkey.id/TXT"
-}
-
-import {
-  to = module.gitea_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/git/A"
-}
-
-import {
-  to = module.gitea_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/git/AAAA"
-}
-
-import {
-  to = module.helm-repo_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/repo/A"
-}
-
-import {
-  to = module.helm-repo_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/repo/AAAA"
-}
-
-import {
-  to = module.statping_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/status/A"
-}
-
-import {
-  to = module.statping_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/status/AAAA"
-}
-
-import {
-  to = module.personal_website_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/@/A"
-}
-
-import {
-  to = module.personal_website_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/@/AAAA"
-}
-
-import {
-  to = module.personal_website_domain.hcloud_zone_rrset.uberspace_domain_key[0]
-  id = "2martens.de/uberspace._domainkey/TXT"
-}
-
-import {
-  to = module.medium_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/medium/A"
-}
-
-import {
-  to = module.medium_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/medium/AAAA"
-}
-
-import {
-  to = module.appreview_domain.hcloud_zone_rrset.mx[0]
-  id = "2martens.de/appreview/MX"
-}
-
-import {
-  to = module.appreview_domain.hcloud_zone_rrset.txt[0]
-  id = "2martens.de/appreview/TXT"
-}
-
-import {
-  to = module.appreview_domain.hcloud_zone_rrset.uberspace_domain_key[0]
-  id = "2martens.de/uberspace._domainkey.appreview/TXT"
-}
-
-import {
-  to = module.cms_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/cms/A"
-}
-
-import {
-  to = module.cms_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/cms/AAAA"
-}
-
-import {
-  to = module.nas_domain.hcloud_zone_rrset.a[0]
-  id = "2martens.de/nas/A"
-}
-
-import {
-  to = module.nas_domain.hcloud_zone_rrset.aaaa[0]
-  id = "2martens.de/nas/AAAA"
+  to = module.cdn_domain.hcloud_zone_rrset.validation
+  id = "2martens.de/_4741e2d9c8a605950eebfa048029e4ef.cdn/CNAME"
 }
\ No newline at end of file
diff --git a/terraform/modules/aws_cdn/main.tf b/terraform/modules/aws_cdn/main.tf
new file mode 100644
index 0000000..2198a5f
--- /dev/null
+++ b/terraform/modules/aws_cdn/main.tf
@@ -0,0 +1,25 @@
+resource "hcloud_zone_rrset" "cname" {
+  zone = var.domain
+  name = var.subdomain != "" ? var.subdomain : "@"
+  type = "CNAME"
+  ttl  = 3600
+
+  change_protection = true
+
+  records = [
+    { value = var.cname_target }
+  ]
+}
+
+resource "hcloud_zone_rrset" "validation" {
+  zone = var.domain
+  name = var.subdomain != "" ? format("%s.%s", var.validation_key, var.subdomain) : var.validation_key
+  type = "CNAME"
+  ttl  = 3600
+
+  change_protection = true
+
+  records = [
+    { value = var.validation_target }
+  ]
+}
\ No newline at end of file
diff --git a/terraform/modules/aws_cdn/outputs.tf b/terraform/modules/aws_cdn/outputs.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/modules/aws_cdn/variables.tf b/terraform/modules/aws_cdn/variables.tf
new file mode 100644
index 0000000..dd8b201
--- /dev/null
+++ b/terraform/modules/aws_cdn/variables.tf
@@ -0,0 +1,20 @@
+variable "domain" {
+  type = string
+}
+
+variable "subdomain" {
+  type    = string
+  default = ""
+}
+
+variable "cname_target" {
+  type = string
+}
+
+variable "validation_key" {
+  type = string
+}
+
+variable "validation_target" {
+  type = string
+}
diff --git a/terraform/modules/aws_cdn/versions.tf b/terraform/modules/aws_cdn/versions.tf
new file mode 100644
index 0000000..a52f718
--- /dev/null
+++ b/terraform/modules/aws_cdn/versions.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = ">= 1.44.1"
+    }
+  }
+}
diff --git a/terraform/modules/domain/main.tf b/terraform/modules/domain/main.tf
index 9088cb4..c5c769b 100644
--- a/terraform/modules/domain/main.tf
+++ b/terraform/modules/domain/main.tf
@@ -6,6 +6,8 @@ resource "hcloud_zone_rrset" "a" {
   type = "A"
   ttl  = 3600
 
+  change_protection = true
+
   records = [
     { value = var.ipv4 }
   ]
@@ -19,6 +21,8 @@ resource "hcloud_zone_rrset" "aaaa" {
   type = "AAAA"
   ttl  = 3600
 
+  change_protection = true
+
   records = [
     { value = var.ipv6 }
   ]
@@ -32,6 +36,8 @@ resource "hcloud_zone_rrset" "mx" {
   type = "MX"
   ttl  = 3600
 
+  change_protection = true
+
   records = [
     { value = format("%s %s.", var.mxPrio, var.hostName) }
   ]
@@ -45,8 +51,10 @@ resource "hcloud_zone_rrset" "txt" {
   type = "TXT"
   ttl  = 3600
 
+  change_protection = true
+
   records = [
-    for txtValue in var.txtValues:
+    for txtValue in var.txtValues :
     { value = provider::hcloud::txt_record(txtValue) }
   ]
 }
@@ -59,7 +67,9 @@ resource "hcloud_zone_rrset" "uberspace_domain_key" {
   type = "TXT"
   ttl  = 3600
 
+  change_protection = true
+
   records = [
     { value = provider::hcloud::txt_record(var.uberspaceDomainKey) }
   ]
-}
\ No newline at end of file
+}
diff --git a/terraform/nameserver-records.tf b/terraform/nameserver-records.tf
index ddf0343..20e02fa 100644
--- a/terraform/nameserver-records.tf
+++ b/terraform/nameserver-records.tf
@@ -21,4 +21,13 @@ module "nas_domain" {
   subdomain = "nas"
   ipv4      = "31.19.63.181"
   ipv6      = "2a02:8108:c19:c400:9209:d0ff:fe70:7570"
-}
\ No newline at end of file
+}
+
+module "cdn_domain" {
+  source             = "./modules/aws_cdn"
+  domain             = hcloud_zone.twomartens_de.name
+  subdomain          = "cdn"
+  cname_target       = "d1fvxyvcoii67h.cloudfront.net."
+  validation_key     = "_4741e2d9c8a605950eebfa048029e4ef"
+  validation_target = "_cf71e85bb40cc12717f2718e4590ad23.acm-validations.aws."
+}