How do I resolve redirect errors in CloudFront?

Resolution

To resolve redirect loops and "too many redirects" errors in your follow these steps for your CloudFront distribution.

Verify that the settings for your CloudFront distribution behavior are correctly configured

To verify your settings, take the following actions:

• Make sure that the Canonical Name Records (CNAMEs) are added to your CloudFront distribution with the correct SSL/TLS certificate.
• Check your cache behavior settings. Make sure that the origin configuration and any associated Lambda@Edge functions or CloudFront functions are configured correctly.
• Verify that you set your viewer protocol policy to HTTP and HTTPS, Redirect HTTP to HTTPS, or HTTPS Only.
  Note: If you require HTTPS between CloudFront and your custom origin, then verify that your origin protocol policy is set to HTTPS Only.

Troubleshoot constant redirection issues

In a typical workflow, a client connects to CloudFront, and then CloudFront connects to the origin server. The origin protocol policy of your distribution and the redirection policy of the origin server must be compatible.

If you see constant redirection when you use CloudFront to load your website or application, then check the origin configuration on CloudFront. This issue can occur because of protocol mismatches between CloudFront and the origin server's configuration.

For example, your origin server redirects all HTTP requests to HTTPS, and your distribution's origin protocol policy is set to HTTP. If the client requests http://d12345.cloudfront.net/example.image, then CloudFront makes a request to the origin server to get the content over HTTP. The request arrives at the origin server, and then the server redirects the request from HTTP to HTTPS. The request routes back to CloudFront with HTTPS. Then, CloudFront uses HTTP to make a request to the origin and restarts the request loop.

To resolve constant redirection, require HTTPS for communication between CloudFront and your custom origin. However, it's a best practice to not use HTTP requests for sensitive information because the communication is in plaintext.

Note: You must have a valid SSL/TLS certificate on your custom origin server. If you don't have a valid certificate on your origin server, then remove the redirection policy and configure the origin server to accept HTTP requests.

Use an edge function to redirect your domain

For information on how to use an an edge function to redirect your domain, see How do I redirect a domain in CloudFront?

Configure Route 53 and domain settings

If you use Amazon Route 53 for DNS management, then make sure that your domain records configuration correctly directs to the CloudFront distribution.

Complete the following steps:

1. Open the Route 53 console.
2. From the navigation pane, choose Hosted zones.
3. In Hosted zone name, make sure that the domain name matches the domain for your CloudFront distribution.
4. In Hosted zone name, select your domain name.
5. In Records, select your record name, and then choose Edit record.
6. Choose the Routing policy dropdown list, and then choose Simple routing.
7. Choose Save.

Related information

How do I use a single CloudFront web distribution to serve content from multiple origins that use multiple behaviors?