How do I troubleshoot CloudFront distribution access issues with CNAMEs and custom origins?

Resolution

Use the following troubleshooting steps to resolve issues with your CloudFront distribution that's configured with CNAMEs or custom origins.

Note: CNAME is also known as an alternative domain name.

SSL/TLS certificate issues

If you can access content from the distribution URL but receive SSL/TLS errors through the CNAME record, then it might be a certificate mismatch issue. Make sure that the SSL/TLS certificate that's associated with your CloudFront distribution includes the CNAME record.

If you require an HTTPS connection between a custom origin and your CloudFront distribution, then mismatched domain names might cause errors. For example, the domain names don't match and the SSL/TLS handshake fails. CloudFront returns an "HTTP status code 502" error. To resolve this issue, see SSL/TLS negotiation failure between CloudFront and a custom origin server.

Note: You can't associate more than one SSL/TLS certificate with an individual CloudFront distribution. For more information, see Can I associate multiple SSL/TLS certificates with my CloudFront distribution?

If you use HTTPS, then you must associate an SSL/TLS certificate with the CloudFront distribution's CNAME record. Use AWS Certificate Manager (ACM) to import a certificate or request a public certificate.

Note: If you tried to delete an SSL/TLS certificate and received an error message that CloudFront is using the certificate, then check your configuration requirements. For more information, see Error message: Certificate: is being used by CloudFront.

CNAME record misconfiguration

Make sure that the CNAME record is correct in the CloudFront distribution settings. Attach a valid SSL/TLS certificate that includes the alternate domain name to the distribution. You must use a fully qualified domain name (FQDN), such as www.example.com, or a wildcard alternate domain name, such as *.example.com.

If you have multiple domain records, then make sure to separate them with commas or enter each domain name on a new line. Also, make sure that your CNAME record points to your distribution's domain name instead of your Amazon Simple Storage Service (Amazon S3) bucket. For more information, see Is your alternate domain name (CNAME) correctly configured?

DNS routing issues

Verify that your DNS records configuration correctly routes traffic for the CNAME to the CloudFront distribution. In Amazon Route 53, create an alias record that maps the domain name to the CloudFront distribution's domain name. If you received the "incorrectly configured DNS record error" message, then you might have an existing wildcard DNS entry that points to your distribution. For more information, see CloudFront returns an incorrectly configured DNS record error when I try to add a new CNAME.

Access denied errors

You might receive "403 Access Denied" errors in the following scenarios:

• Your distribution restricts access to an Amazon S3 origin. Make sure that the bucket policy grants the required permissions to the Origin Access Identity (OAI) to access the S3 bucket. For more information, see Restrict access to an Amazon S3 origin.
• You configured your distribution to return custom error responses from an S3 origin. Make sure that the OAI has read access to the S3 bucket.
• You activated AWS WAF for your distribution. Review the AWS WAF logs to determine whether firewall rules blocked requests.
• Your distribution uses an Amazon S3 REST API endpoint as the origin domain name. Check your configuration requirements. For more information, see Why do I get 403 Access Denied errors when I use an S3 REST API endpoint as the origin of my CloudFront distribution?
• You use an Amazon S3 website endpoint as the origin for your distribution. Check your configuration requirements. For more information, see Why do I get a "403 access denied" error when I use an Amazon S3 website endpoint as the origin of my CloudFront distribution?
• Your AWS Identity and Access Management (IAM) role or user doesn't have a required permission on a CloudFront resource or has incorrect credential issues. Check your credentials, and make sure that your IAM user or role has the necessary permissions.

DNS resolution failures for private or internal origins

If you use a private or internal resource as the origin for your distribution, then the distribution might fail to resolve the origin's DNS name. For example, if you use an Application Load Balancer or a private resource inside a virtual private cloud (VPC) as the origin.

Public origins

Confirm the following configurations for public origins:

• Make sure that the origin has internet access. For Application Load Balancers, change the schema setting from internal to internet-facing. For resources in a VPC, make sure that the subnet has a route to the internet.
• Use the public DNS name as the origin domain name in your CloudFront distribution settings.
• If your origin is in a VPC, then add the CloudFront IP address ranges to configure a security group rule that allows inbound traffic from CloudFront.

Private origins

For private origins, create a VPC origin for a new or existing distribution. For more information, see Restrict access with VPC origins.

Custom origins access errors

If you received "HTTP 503 status code" or "OriginDnsError" error when you tried to access your custom origin through CloudFront, then check the following:

• If you use a custom or VPC origin, then check the origin response timeout configuration. If you set the value too low, then CloudFront times out before it receives a response from the origin. For more information, see Response timeout (custom and VPC origins only).
• Make sure that the Origin Protocol Policy field matches the protocol that your origin server uses. Mismatches between the CloudFront Origin Protocol Policy field and the origin might change the URL and cause access issues.
• If you configured CloudFront to add custom headers to origin requests, then confirm that the header name and value settings are correct. Make sure that your configuration doesn't use custom headers that CloudFront can't add to origin requests.

Related information

Why does my application fail on CloudFront when I can use the application from a custom origin?

How do I increase my custom origin's response timeout in CloudFront?

Troubleshooting distribution issues