Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Route 53 CloudFront error

0

Hello,
I have an A Simple record that points to an IP in Route 53 that used to work until few hours ago.
Now, without any interaction from my side, I have a CloudFront error , without any configuration of a CloudFront Alias for this record. When I test the record using the Route 53 Test tool, the return is ok: the IP configured.
Could you please specify which is the reason of the error ?
Thank you,

  • Florian Turnwald EXPERT
    a month ago

    If my answer was helpful, I would appreciate it if you could mark it as the accepted answer.

Topics
Networking & Content Delivery
Tags
Amazon Route 53Networking & Content Delivery
Language
English

asked a month ago53 views

2 Answers
2

As far as I know, the Route 53 Test Tool queries authoritative nameservers directly, which is why it confirms your A record IP. However, getting a CloudFront error when hitting a static IP usually comes down to one of two issues:

  1. The IP address belongs to CloudFront: If you populated the A record using an IP address obtained by pinging a CloudFront distribution, this setup will fail unpredictably. CloudFront IP ranges change dynamically, and edge servers will reject requests if the domain isn't registered as an Alternate Domain Name (CNAME) in the distribution configuration.
  • Fix: If your target is CloudFront, do not use static IP A records. Delete the record and create an Alias record in Route 53 pointing directly to your d111111abcdef8.cloudfront.net distribution.
  1. DNS Caching or Upstream Proxying:
  • Stale Resolver Cache: If the domain previously pointed to CloudFront, your local machine or ISP DNS resolver might still serve a cached response. Try testing via dig +trace yourdomain.com or flushing your local DNS cache (ipconfig /flushdns).
  • Backend uses CloudFront: If the destination IP belongs to an AWS service that uses CloudFront under the hood (e.g., API Gateway Edge-Optimized endpoints or a third-party host), that service must be configured to recognize your custom domain in its Host header.

Reference:

EXPERT

answered a month ago

  • rePost-User-4717319
    a month ago

    Thank you for your answer,

    After some investigations, I detected that the behaviour was due to a website monitor that used Route 53 to switch the traffic to a Failover Secondary website backed by S3 with AWS CDN. That is why the issue appeared suddenly. When I replaced current CDN with another CDN with different configuration, everything worked fine.

    Is it possible to know from the Postman answer which CloudFront Distribution is used (all ids in headers are changing on each request) ?

    Thank you,

  • Florian Turnwald EXPERT
    a month ago

    No, it is not possible to identify the CloudFront Distribution ID directly from the HTTP response headers in Postman.

    The changing IDs you see (such as X-Amz-Cf-Id) are unique request identifiers, not the distribution ID. For security reasons, AWS does not expose backend distribution details to the client. To determine which distribution handled the traffic, you need to search your AWS CloudFront access logs using that specific X-Amz-Cf-Id.

0

Based on the error you're experiencing, it appears that a DNS record may be pointing to a CloudFront distribution, but the distribution isn't configured to accept requests for that domain name.

This typically happens when:

  1. CNAME mismatch: A DNS record (like your A record or a CNAME) is routing traffic to CloudFront, but the alternate domain name (CNAME) hasn't been added to the CloudFront distribution's configuration. Even if you create the DNS record correctly, if the CNAME isn't added to the CloudFront distribution settings, requests will return an error.

  2. Wildcard DNS entry: There might be an existing wildcard DNS entry that's inadvertently routing your traffic to a CloudFront distribution.

To resolve this issue:

  • Verify your DNS configuration in Route 53 to ensure there are no unexpected CNAME records or wildcard entries that might be routing traffic to CloudFront
  • If you do have a CloudFront distribution that should serve this domain, make sure to add the domain name as an alternate domain name (CNAME) in your CloudFront distribution configuration
  • Check if there are any other DNS records (beyond the A record you mentioned) that might be affecting traffic routing

Since you mentioned this worked previously without any changes on your end, I'd recommend carefully reviewing all DNS records associated with your domain in Route 53 to identify any unexpected configurations that might have been introduced.
Sources
HTTP 403 status code (Permission Denied) - Amazon CloudFront
Troubleshoot CloudFront distribution access issues with CNAMEs and custom origins | AWS re:Post

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content