AWS CloudFront Support
Fixing CloudFront 403, 502 and 504 errors.
A CloudFront error page can come from the edge, from your origin, or from the connection between them. The X-Cache header and the error text tell you which. We find the failing layer first, then fix the real cause instead of guessing at settings.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Users see "The request could not be satisfied" from CloudFront
- A site works on the origin URL but fails through the distribution
- Errors started after an origin, certificate or behavior change
- Only some paths, regions or file types return errors
- A private S3 origin returns AccessDenied through CloudFront
What you get
- A root-cause note naming the failing layer and the fix
- Corrected distribution, origin and certificate settings in infrastructure as code
- Alarms on 4xx and 5xx error rate with sensible thresholds
- A troubleshooting runbook for your team
How we do it
A clear, safe process you can follow along with.
1. Read the response headers
We request the failing URL with curl -I and read X-Cache, Via and X-Amz-Cf-Id. An "Error from cloudfront" value means CloudFront generated the error; otherwise the origin returned it and CloudFront passed it through.
2. Rule out 403 causes
For 403 we check alternate domain names (CNAMEs) and the attached certificate, geo restriction, an attached WAF web ACL, signed URL requirements, and for S3 origins the bucket policy and origin access control settings.
3. Diagnose 502 causes
502 usually means CloudFront could not complete a connection to the origin. We test TLS from outside: certificate name mismatch, expired or untrusted certificate, unsupported protocol or cipher, or a Lambda@Edge function returning an invalid response.
4. Diagnose 504 causes
504 means the origin did not answer in time. We compare origin response timeout and keep-alive settings with real origin latency, and check whether the origin security group or firewall blocks CloudFront IP ranges.
5. Use logs to confirm
We enable standard or real-time logs and filter by x-edge-result-type and x-edge-detailed-result-type, which separate Error, OriginDnsError and similar results, and match them with origin logs by request ID.
6. Fix and verify
We correct the cause, then retest with curl from several locations and watch the 4xxErrorRate and 5xxErrorRate metrics. We also set a custom error response with a short error-caching TTL so one bad moment is not cached for long.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Debugging the origin when CloudFront made the error
Check X-Cache first. If CloudFront generated the error, origin logs will show nothing.
Leaving the Host header unforwarded
Origins that route by hostname can reject CloudFront requests. We forward or override the Host header deliberately.
Long error caching
CloudFront caches error responses for a default period, so a fixed origin can keep serving errors. We set error caching minimum TTL on purpose.
Origin certificate does not match
With HTTPS to the origin, the certificate must match the origin domain name configured, not your public domain.
Frequently Asked Questions
What does a CloudFront 502 error mean?
CloudFront could not get a valid response from the origin. Common causes are TLS or certificate problems between CloudFront and the origin, an unreachable origin, or an invalid response from a Lambda@Edge function.
Why do I get a 403 from CloudFront with an S3 origin?
Usually the bucket policy does not allow the CloudFront distribution, the object does not exist and listing is not permitted, or a default root object is missing. We check each in order.
How do I fix a CloudFront 504 gateway timeout?
Find out why the origin is slow or unreachable, then adjust the origin response timeout only if the work legitimately takes longer. Raising timeouts alone hides a slow origin.
Want Help With Fixing CloudFront 403, 502 and 504 errors?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required