Cloudfront 'Shadow Disabled' and stopped serving traffic

Question

Hello,
A strange case has come up on one of our Cloudfront distributions. Seemingly at random, one of our distributions stopped serving traffic. Upon further investigation, it appears that the distribution is unable to be modified with an "Access Denied" error on making any modifications. This happens with no other distributions, this distribution worked previously. The account accessing it has admin access.

The CNAME itself "https://d1l854btlj2kq.cloudfront.net" appears to not point to internal AWS IPs as other Cloudfront distributions do.

When selecting the distribution from the listing page, though it shows as enabled, the only option in the top right is 'delete'.

When looking at the api response from the browser network tab it has the tag:
"false".

We attempted to delete the distribution and recreate it, which required a customer to update their DNS. A day later, the same issue occurred on the new distribution.

The distribution id is "EG8O9R2VTBWBX" and is still not working. All logs shut off at around 14:00 UTC yesterday and it seems to be entirely 'bricked'.

Furthermore, an error started popping up on our AWS account relating to Cloudfront distributions limit "TooManyDistributions". However, upon deleting some distributions, it still appears. The listed quota on our account is 500 and we have around 180 distributions.

If anyone has insight onto what this might be caused by, I appreciate it.

Thanks, 
  Allan

re:Post Agent · Answer

Based on your description, it sounds like you're experiencing an unusual issue with your CloudFront distribution where it appears to be enabled but isn't serving traffic.

The "AdminEnabled" flag being set to false suggests that the distribution has been administratively disabled, which is different from the regular enabled/disabled state that you can control through the console. This administrative disabling could explain why you're seeing "Access Denied" errors when trying to modify the distribution and why the only available option is to delete it.

When a CloudFront distribution is disabled (either normally or administratively), it stops accepting end-user requests that use the domain name associated with that distribution. This explains why your distribution stopped serving traffic even though it appears to be enabled in the console.

The fact that your CloudFront domain name isn't resolving to AWS IPs is consistent with this disabled state. When a distribution is properly enabled and deployed, CloudFront accepts and handles requests using the distribution's domain name.

Regarding the "TooManyDistributions" error, there might be a discrepancy between the actual number of distributions and what's being counted against your quota. Sometimes, distributions that are in the process of being deleted or are in an unusual state might still count against your quota temporarily.

For this specific issue, I recommend:

1. Contact AWS Support directly as they can investigate the administrative disabling of your distribution and the quota issues you're experiencing.

2. Check if there are any AWS Organizations policies, Service Control Policies (SCPs), or other account-level restrictions that might be affecting your CloudFront distributions.

3. Verify if there were any security-related events or automated responses that might have triggered this administrative disabling.

4. When creating a new distribution, ensure that all settings are properly configured, especially any security-related settings or origin configurations.

Since this happened to both the original and replacement distribution, there might be an underlying account-level issue or configuration problem that's causing CloudFront to administratively disable your distributions.  
**Sources**  
[Distribution settings - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html)  
[The CloudFront Distribution did not handle requests from outside for two hours 18.01.25. | AWS re:Post](https://repost.aws/questions/QUN7I5tW1GSOi1zsN1dP8E7A/the-cloudfront-distribution-did-not-handle-requests-from-outside-for-two-hours-18-01-25)  
[all of my cloudfront domain request fail | AWS re:Post](https://repost.aws/questions/QUC2Fk1rfkRr2OqhRSDCPeMw/all-of-my-cloudfront-domain-request-fail)

Cloudfront 'Shadow Disabled' and stopped serving traffic

Add your answer

Relevant content