Cloudfron 403 error messsage

Question

Hi,
Getting this error msg:
Service: CloudFront, Status Code: 403, Request ID: 56971a4f-d7c2-4c81-a6ac-4b507c2d2339...Submit the case and wait for AWS Support to respond.

Riku_Kobayashi · Answer

Hello.

First, please check the troubleshooting method in the following document.  
https://repost.aws/knowledge-center/cloudfront-troubleshoot-403-errors

It's difficult to troubleshoot with only that error message, so could you please share the CloudFront configuration and origin configuration?  
As mentioned in the above document, a 403 error may occur simply due to insufficient CNAME record settings.

Also, check whether a 403 error is returned not only on CloudFront but also on the origin side.

Basel Mohamed · Answer

Common Causes:
Invalid or Missing Permissions: IAM roles or users may not have the necessary permissions.
Bucket Policy Issues: The S3 bucket policy might not allow access from CloudFront.
Origin Access Identity (OAI) Issues: The OAI might not have the correct permissions.
CloudFront Distribution Settings: Restrictive settings within the CloudFront distribution could be blocking access.

Steps to Diagnose and Resolve:
Check IAM Permissions:
Ensure the IAM user or role has the required permissions for CloudFront and the resources it accesses.
Review Bucket Policy:

Ensure your S3 bucket policy allows CloudFront access. Example policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity YOUR_OAI_ID"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        }
    ]
}
Replace YOUR_OAI_ID and YOUR_BUCKET_NAME with your actual values.
Validate OAI Configuration:
Ensure the OAI is correctly associated with your CloudFront distribution.
Check this in the CloudFront console under 'Origins and Origin Groups'.
Inspect CloudFront Distribution Settings:

Check the 'Behaviors' tab in your CloudFront distribution for correct settings.
Ensure allowed HTTP methods and caching settings are appropriate.

Submitting a Case to AWS Support:
Go to the AWS Support Center.
Click 'Create case'.
Select 'Technical support'.
Provide details including the error message and request ID.
Submit the case and wait for AWS Support to respond.

Soporte · Answer

I'm not totally sure if permissions is the issue as I'm using admin role with all resources permissions as needed...any other idea?
thank you,

Cloudfron 403 error messsage

Add your answer

Relevant content