Amplify throwing 403 ERROR

Question

I have a Next.js project hosted on AWS Amplify. It was deployed to Amplify about 5 months ago. It has not been updated or re-deployed since then, and has been working without error.

The project uses Upstash to process background jobs. Again, this has all been working flawlessly for the past months, since the App was deployed to Amplify.

https://upstash.com/

On Friday, 20 June, the App failed the background job in the middle of the process. Looking at the Upstash logs I am getting 403 ERROR, The request could not be satisfied. Bad request. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.

Thinking it was an Upstash issue, I reached out to their support. They did a deep dive and believe it is an AWS Issue relating to the CloudFront configuration.

At the time, my Amplify setup was vanilla; the (new) Firewall / WAF was not enabled in the Amplify App. I though this may have been the reason and went ahead and enabled it. But I can confirm that with WAF enabled or disabled I am getting the same result.

The App does have a Custom Domain attached to it. And again, it has been working without error for the past months. Then out of the blue, started failing on Friday, 20 June.

Any ideas what may be causing this ?

re:Post Agent · Answer

The 403 error you're experiencing with your AWS Amplify hosted Next.js application could be due to several potential causes, especially since it occurred suddenly without any changes to your deployment.

Based on the information provided, here are some possible causes and solutions:

1. **Intermittent CloudFront Issues**: The 403 error from CloudFront can occur randomly or intermittently. This is a known issue with Amplify applications where requests might fail with a 403 error but work fine on refresh. Since your background jobs are failing in the middle of processing, this could be related to this intermittent behavior.

2. **AWS WAF Rules**: Even though you mentioned the WAF was not enabled initially when the issue started, there might be default AWS WAF rules or configurations that are blocking your background job requests. When CloudFront sits behind AWS WAF, it can be difficult to distinguish between a 403 from your origin and a 403 from AWS WAF blocking a request.

3. **Authorization Headers**: If your background jobs require authorization headers for API requests, there might be an intermittent issue with these headers not being properly attached to requests, causing 403 Forbidden errors. This is a known issue with AWS Amplify where authorization headers are occasionally missing from API requests.

4. **CloudFront Configuration**: There might have been changes to the underlying CloudFront distribution that Amplify manages on your behalf, even if you didn't make any changes to your application.

Here are some troubleshooting steps you can take:

1. Check CloudFront logs and AWS WAF logs (if enabled) to see if there are any patterns to the 403 errors.

2. Implement more detailed error logging in your application to capture information about the failed requests.

3. Try invalidating the CloudFront cache for your application.

4. If your background jobs use authentication, verify that tokens are being properly managed and refreshed.

5. Contact AWS Support as they can provide more detailed information about any changes or issues with the underlying CloudFront distribution that Amplify manages.

Since this issue started suddenly without any changes on your part, it's possible that there was an update or change on AWS's side that is affecting your application's behavior with external services like Upstash.  
**Sources**  
[Amplify 403 Error | AWS re:Post](https://repost.aws/questions/QUcu787tVGTYCblkSN2HU6QA/amplify-403-error)  
[Intermittent Authorization Header Issue with AWS Amplify | AWS re:Post](https://repost.aws/questions/QU9YkXqz_VQIKyBcN170neNQ/intermittent-authorization-header-issue-with-aws-amplify)  
[Firewall support for AWS Amplify hosted sites | AWS News Blog](https://aws.amazon.com/blogs/aws/firewall-support-for-aws-amplify-hosted-sites/)  
[HTTP 403 status code (Permission Denied) - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-403-permission-denied.html)

Shahed Kazi (@shajam) · Answer

Hello, based on AWS documentation - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-403-permission-denied.html - there could be a number of reasons for 403 errors.

In your CloudFront distribution, do you have geographic restrictions - blocking the application can from certain regions. It's possible Upstash is interacting with your application from different region - maybe they alter at a time  interval or there is a maintenance window and your CloudFront configuration is blocking this alternate location.

Amplify throwing 403 ERROR

Add your answer

Relevant content