So I assume you have a web server somewhere which is configured to host virtual hosts in some regard. You need to set up a virtual host which is configured to respond to requests for mydomain.com and reply with a redirect to aa.mydomain.com. The DNS for the domain root must be an A record, so you will have to set the IP address for your web server on the A record for mydomain.com. How exactly this looks and what sticky points you have in setting this up depends on what your web server setup is like - maybe you have this all working, but if not, if this is just an apache or nginx install, then we need to work through setting up the virtual host, or if this is a docker style nginx letsencrypt manager, then thats another set of configuration issues.
Let me know how far you've gotten, or if nowhere at all and you need a recommendation for how to do this, let me know. Let me know a little more about your web server environment that responds to mydomain.com if you have one set up (linux? windows? router with pfsense?)
The way I do this is my router forwards all http and https traffic to my web server running ubuntu, and docker-letsencrypt-nginx-proxy-companion handles all the virtual hosts. Then if I wanted to create a redirect for a single domain, I would make a docker container that served an nginx server and have it configured with a redirect. But I must acknowledge I've been a sysadmin for 10 years and there may be more user friendly turnkey ways to do this, I'm just doing what works for me.