Cloudfront Post Request Keeps giving 403

Question

This is my cloudfront setup using Terraform.

```
locals {
  s3_origin_id             = "S3OriginId-for-${var.client_bucket_name}"
  s3_origin_access_control = "OriginAccessControl-for-${var.client_bucket_name}"
  apigw_origin_id          = "APIGatewayOriginId"
  apigw_domain_name        = element(split("://", var.apigw_domain_name), 1)
}

resource "aws_cloudfront_origin_access_control" "s3_origin_access_control" {
  name                              = local.s3_origin_access_control
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "cdn" {
  origin {
    domain_name              = var.client_bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.s3_origin_access_control.id
    origin_id                = local.s3_origin_id
  }

origin {
    origin_id   = local.apigw_origin_id
    domain_name = local.apigw_domain_name
    origin_path = "/${var.api_stage}/upload_url"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

enabled = true
  default_cache_behavior {
    allowed_methods  = ["HEAD", "GET", "OPTIONS"]
    cached_methods   = ["HEAD", "GET", "OPTIONS"]
    target_origin_id = local.s3_origin_id

forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

ordered_cache_behavior {
    path_pattern     = "/api/upload-url"
    allowed_methods  = ["HEAD", "GET", "OPTIONS", "POST", "PATCH", "PUT", "DELETE"]
    cached_methods   = ["HEAD", "GET", "OPTIONS"]
    target_origin_id = local.apigw_origin_id

cache_policy_id          = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
    origin_request_policy_id = "b689b0a8-53d0-40ab-baf2-68738e2966ac"

viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 0
    max_ttl                = 0
  }
  
  price_class = "PriceClass_100"

restrictions {
    geo_restriction {
      restriction_type = "none"
      locations = []
    }
  }

viewer_certificate {
    cloudfront_default_certificate = true
  }
}
```
[Error I get](/media/postImages/original/IM8SEpKRXXT4WImJLuSkRGmQ)

[From console](/media/postImages/original/IMzabmAvPqROu-B4OHJSUD0Q)

Nitin Bhadauria · Answer

Looks like you are missing a trailing slash in path_pattern try to add a slash.

ordered_cache_behavior {
    path_pattern     = "/api/upload-url/"

Leo K · Answer

I think the other response is correct about the exact URL path shown in the test request in the screenshot, but to be sure, if the intent is to allow all URLs with that prefix, you'll additionally need a trailing `*` wildcard. For example, `/api/upload-url/*` or `api/upload-url/*` (the leading slash is not required but it is allowed).

The path pattern syntax is explained in detail in this documentation article, but the short version is that `*` matches zero or more characters and `?` matches exactly one character: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesPathPattern

Nitin Bhadauria · Answer

What is the error code after you updated the trailing slash? do you have logs enabled on API Gateway? If yes please share the logs.

Also based on your code I hope you have configured your API Gateway to handle request on "/${var.api_stage}/upload_url/api/upload-url/" and not on "/api/upload-url/"

Also if you can share the cache_policy and origin_request_policy, it might be relevant.

Cloudfront Post Request Keeps giving 403

Add your answer

Relevant content