SteadyNode

AWS CloudFront · HTTP 403

CloudFront 403: Origin Access Denied

Troubleshoot CloudFront 403 responses by checking origin access control, bucket policy, signed URL rules, and cache behavior path matching.

Origin / Application

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

AWS_CLOUDFRONT_403_ACCESS_DENIED

Fault domain

Origin / Application

Why it happened

The request reached a policy boundary but did not satisfy it. Common causes include a bucket policy that omits the distribution, an incorrect origin access control association, or a path that requires a signature.

Actionable fixes

  1. Check the matching cache behavior and identify whether CloudFront or the origin generated the 403.
  2. Verify the distribution's origin access control and the least-privilege bucket policy resource and principal.
  3. Confirm signed URL or cookie requirements and invalidate cached errors only after correcting the policy.

Why this error happened

The request reached a policy boundary but did not satisfy it. Common causes include a bucket policy that omits the distribution, an incorrect origin access control association, or a path that requires a signature.

Actionable fixes

  1. Check the matching cache behavior and identify whether CloudFront or the origin generated the 403.
  2. Verify the distribution's origin access control and the least-privilege bucket policy resource and principal.
  3. Confirm signed URL or cookie requirements and invalidate cached errors only after correcting the policy.

Network failure point

Client -> CloudFront behavior -> origin policy check -> access denied -> X

Verify origin directly via CLI

curl -sS -I -v --max-time 20 https://example.com/private/object

Configuration fix

cloudfront.tfhcl
origin_access_control_id = aws_cloudfront_origin_access_control.site.id

resource "aws_cloudfront_origin_access_control" "site" {
  name                              = "site-origin"
  origin_access_control_origin_type = "s3"
  signing_behavior                 = "always"
  signing_protocol                  = "sigv4"
}

Catch this failure before it becomes an outage

SteadyNode checks public routes continuously and records status changes, helping teams catch accidental access-policy changes without exposing private response content.

No credit card required.

Start for free

Frequently asked questions

Why does CloudFront return 403 for a public S3 object?

The bucket policy or origin access control may not grant the distribution access, or the request may match a behavior that requires a signature.

Should I make the origin public to fix 403?

No. Correct the distribution's origin access control and least-privilege policy instead of removing the origin's access boundary.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy