Renewed CloudFront SSL certificate causing 404 errors on previously working S3 bucket deployment

The 404 errors you're experiencing after renewing your CloudFront SSL certificate and creating a new distribution are likely not directly related to the certificate itself, but rather to the configuration of your new CloudFront distribution. Here are some potential reasons and areas to check:

1. Origin Configuration: Ensure that the new CloudFront distribution is correctly pointing to your S3 bucket as the origin. The origin domain name should be in the format "your-bucket-name.s3.amazonaws.com" (not the S3 website endpoint).

2. Origin Access: If you're using Origin Access Identity (OAI) or Origin Access Control (OAC), make sure it's properly set up in the new distribution and that your S3 bucket policy allows access from this new CloudFront distribution.

3. Default Root Object: Check if you have set the default root object (e.g., index.html) in your new CloudFront distribution settings. This is important for serving the main page of your website.

4. Bucket Policy: Verify that your S3 bucket policy allows the new CloudFront distribution to access the objects. You may need to update the policy with the new distribution's ARN.

5. CloudFront Behaviors: Ensure that the cache behaviors in your new distribution are set up correctly, including the path patterns and viewer protocol policy.

6. Origin Path: If your files are in a specific folder within the S3 bucket, make sure you've set the correct origin path in your CloudFront distribution settings.

7. Invalidation: If you've made any recent changes, try creating an invalidation in CloudFront to clear the cache.

8. Error Pages: Check your CloudFront error page settings to ensure they're not interfering with the proper display of your content.

9. DNS Propagation: Allow some time for DNS changes to propagate fully after updating your GoDaddy settings.

10. Permissions: Double-check that the objects in your S3 bucket have the necessary permissions for CloudFront to access them.

By systematically reviewing these aspects of your new CloudFront distribution and S3 configuration, you should be able to identify and resolve the issue causing the 404 errors.

Sources
Cloudfront cannot access s3 bucket | AWS re:Post
CloudFront: The resource you requested does not exist Origins S3 | AWS re:Post
HTTP 404 status code (Not Found) - Amazon CloudFront
Hosting HTTPS website using S3, AMC and CloudFront | AWS re:Post

Because you created a new CloudFront Distro, you will need to update the bucket policy to allow the new cloudfront distribution ID.

OAC

{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "AllowCloudFrontServicePrincipalReadOnly",
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::<S3 bucket name>/*",
        "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/<CloudFront distribution ID>"
            }
        }
    }
}

or if your using OAI

{
    "Version": "2012-10-17",
    "Statement": {
            {
            "Sid": "AllowLegacyOAIReadOnly",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <origin access identity ID>"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<S3 bucket name>/*"
        }
      }
}

NOTE: In future, you dont need to recreate the cloudfront, you can just renew the cert

Hi,

Did you try to invalidate the CloudFront cache on the edge to restart from a clean situation ?

See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html#invalidating-objects-api

You may also be interested in this article describing common errors with CloudFront and SSL: https://www.infinitivehost.com/knowledge-base/fix-cloudfront-ssl-issues-a-quick-guide-to-secure-your-site/

Finally, if the above doesn't fix your problem, you want to activate to:

• Enable Logging: Enable logging in CloudFront to monitor access logs for SSL errors. Go to the CloudFront Distribution Settings, and enable Logging under the General tab.
• Monitor CloudWatch: Use AWS CloudWatch to monitor metrics and alarms related to your CloudFront distribution.

Best,

Didier