- Newest
- Most votes
- Most comments
Not answering the question but it's likely that it is less expensive and faster to use a CloudFront Function to do the redirect: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example_cloudfront_functions_redirect_based_on_country_section.html
The issue you're experiencing is likely due to CloudFront caching the redirect response from your S3 bucket. Even though you've changed the redirect in the S3 bucket configuration, CloudFront may still be serving the old redirect from its cache.
To resolve this issue, you can try the following steps:
-
Create an invalidation in CloudFront: This will clear the cached content for your distribution. In the CloudFront console, select your distribution, go to the "Invalidations" tab, and create a new invalidation with the path "/*" to invalidate all objects.
-
Ensure your CloudFront distribution is configured correctly:
- Verify that the origin domain name is set to the S3 website endpoint (e.g., your-bucket-name.s3-website-region.amazonaws.com) rather than the regular S3 bucket endpoint.
- Make sure the origin protocol policy is set to "HTTP Only" since S3 website endpoints only support HTTP.
-
Check your cache behavior settings:
- Set the minimum TTL to 0 to ensure CloudFront checks with the origin more frequently.
- Consider using the "CachingOptimized" policy instead of "CachingDisabled" to allow some caching while still respecting the origin's cache headers.
-
Verify S3 bucket configuration:
- Confirm that the redirect rule in your S3 bucket is correctly set to the new domain.
- Ensure that the S3 bucket has the correct permissions to allow CloudFront to access it.
-
Wait for propagation: After making these changes, it may take some time (usually up to 24 hours) for the changes to fully propagate across all CloudFront edge locations.
If the issue persists after trying these steps, you may need to review your CloudFront distribution's logging settings to gather more information about the requests and responses. This can help identify if there are any specific issues with how CloudFront is handling the redirect from S3.
Remember that when using S3 website hosting for redirects, CloudFront caches the redirect status code and the new location. It doesn't follow the redirect itself but returns these values to the viewer. The viewer then makes a new request to the redirected location.
If you continue to face difficulties, consider reaching out to AWS Support for more personalized assistance with your specific configuration.
Sources
Request and response behavior for Amazon S3 origins - Amazon CloudFront
Renewed CloudFront SSL certificate causing 404 errors on previously working S3 bucket deployment | AWS re:Post
Cloudfront cannot access s3 bucket | AWS re:Post
Relevant content
- asked a month ago
- asked 4 years ago
- AWS OFFICIALUpdated 3 months ago
- AWS OFFICIALUpdated 5 months ago

Thanks for your input.
I did add a simple redirect function and attached it to the distribution. But I had also added a custom caching policy where I set the TTLs to 60 seconds, so I'm not sure which change (or both) worked.
I used a simpler function provided in the documentation here:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/functions-tutorial.html
That said, I would still like to know why the CloudFront distribution remained cached for so long.