Cloudfront not works after change the behavior to UseOriginCacheControlHeaders-QueryStrings

Question

Using the following simple code with FASTAPI and Lambda URL 
```python
@app.get("/testcache/cache")
async def testcache(response: Response):
    # Cache during 1 year
    headers = {
        "X-custom": "test custom header",
        "Cache-Control": "public, max-age=31536000",
    }
    return JSONResponse(
        status_code=status.HTTP_200_OK,
        content={"message": "cache"},
        headers=headers,
    )
```
The code works with **Managed-CachingDisabled Managed-AllViewerExceptHostHeader** (looks like ignore the Cache-Control header and allways return "Miss from cloudfront"
But when I change to  **UseOriginCacheControlHeaders-QueryStrings-AllViewerExceptHostHeader** " I get "403 Forbidden"

> x-amz-cf-id: gcnHsvlAfKdvMxW7RauXeFH_J3aCxf9Sxw13X_KUle3-dbH776K1pw==
> x-amz-cf-pop: MAD53-P4
> x-amzn-errortype: AccessDeniedException
> x-amzn-requestid: e4472002-851b-452f-8d74-1a64b1462c71
> x-cache: Error from cloudfront

Any idea about the reason of this error?

re:Post Agent · Answer

The issue you're experiencing with CloudFront returning a 403 Forbidden error when changing to the "UseOriginCacheControlHeaders-QueryStrings-AllViewerExceptHostHeader" behavior is likely related to authentication or authorization problems between CloudFront and your Lambda origin.

When you switch from "Managed-CachingDisabled" to a policy that uses origin cache control headers, CloudFront attempts to respect the caching directives set by your origin (in this case, your Lambda function). However, this change may be exposing an underlying issue with how CloudFront is authenticating or authorizing requests to your Lambda URL.

Here are a few things to check:

1. Ensure that your Lambda function URL is properly configured to allow access from CloudFront. If you're using IAM authentication for your Lambda function URL, make sure the necessary permissions are in place for CloudFront to access it.

2. Check if you're using Origin Access Control (OAC) or any other access control mechanism between CloudFront and your Lambda origin. Ensure these are correctly set up.

3. Verify that your Lambda function is not inadvertently returning a 403 status code. Although your code snippet shows a 200 OK response, there might be other parts of your application logic causing this.

4. Look into your CloudFront distribution settings to ensure that the origin (Lambda URL) is correctly configured and that there are no conflicting security settings.

5. Check CloudWatch Logs for your Lambda function to see if the requests are reaching it and if there are any error messages that might explain the 403 error.

6. If you're using signed URLs or cookies with CloudFront, ensure they are properly configured and not expired.

The "x-amzn-errortype: AccessDeniedException" in your error response suggests that this is indeed an access or authorization issue. It's possible that the change in caching behavior is triggering a different authentication flow that's not properly set up.

If you continue to face issues after checking these points, you may need to engage AWS Support for a more in-depth investigation, as they can look into the specifics of your CloudFront distribution and Lambda setup.  
**Sources**  
[CloudFront will not work with authorization | AWS re:Post](https://repost.aws/questions/QURN3Opda-Rj6QVkkFw0YY_A/cloudfront-will-not-work-with-authorization)  
[POST request fails due Origin access control on Cloudfront | AWS re:Post](https://repost.aws/questions/QUGrYi20adSFCtuy7Y-mZ9Dw/post-request-fails-due-origin-access-control-on-cloudfront)

Cloudfront not works after change the behavior to UseOriginCacheControlHeaders-QueryStrings

Add your answer

Relevant content