I want to troubleshoot why Amazon CloudFront returns the error message "403 Error - The request could not be satisfied. Request Blocked".
Short description
If you misconfigure your AWS WAF rules, then you might get the following error message:
The "403 Error - The request could not be satisfied. Request Blocked".
The following settings can cause a "Request Blocked" error:
- For rules with a default action set to Allow, you receive a request that matches a rule with an Action set to Block.
- For rules with a default action set to Block, you receive a request that matches a rule with an Action set to Block.
- For rules with a default action set to Block, you receive a request that doesn't match any rules with an Action set to Allow.
For information on how to troubleshoot other types of 403 errors, see How do I troubleshoot 403 errors from CloudFront?
Resolution
To resolve the "Request Blocked" error, complete the following steps:
- Open the CloudFront console.
- In the navigation pane, choose Distributions, and then select the distribution that you want to update.
- Choose the Security tab.
- Under Security - Web Application Firewall (WAF), select the link on the web access control list (web ACL) link. Your web ACL in the WAF Console will open in a new tab.
- Under the Rules tab, review the AWS WAF default action that's set on the web ACL.
Note: For more information, see Setting the web ACL default action in AWS WAF.
To resolve the "Request Blocked" error for rules with a default action of Allow, review your requests. If there are requests that match rule conditions that are set to Block, then update the rule to allow these requests.
To resolve the "Request Blocked" error for rules with a default action of Block, review your requests. The requests must match rule conditions that are set to Allow. If the requests don't match existing rules to allow the requests, then create a rule to allow the requests.
Note: Use the AWS WAF console to review a sample of requests that match the rule that might cause the "Request Blocked" error. For more information, see Testing and tuning your AWS WAF protections.
Related information
How do I resolve "403 ERROR - The request could not be satisfied. Bad Request" in CloudFront?
How AWS WAF works
Use AWS WAF protections