Sev1: CloudFront returns 502 or 504 to everyone — origin TLS, OAC, timeouts and security groups

#Symptoms

• Browsers show a CloudFront error page with 502 ERROR or 504 Gateway Timeout.
• Response headers contain x-cache: Error from cloudfront.
• Origin looks healthy when tested directly.

#1. Classify the error

curl -sI https://www.example.com/ | grep -Ei "HTTP/|x-cache|x-amz-cf-id|server"

Keep the x-amz-cf-id value; AWS Support can trace it.

#2. 502: origin TLS problems

CloudFront requires the origin certificate to be valid, trusted and to match the origin domain name (or the Host header if forwarded).

openssl s_client -connect origin.example.com:443 -servername origin.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -enddate -ext subjectAltName

Check:

• Certificate expired or self-signed → replace with ACM (for ALB) or a public CA cert.
• Origin domain in CloudFront is the ALB DNS name, but the certificate only covers origin.example.com → set the origin domain to a name the cert covers, with a matching DNS record.
• Origin only supports old TLS versions or ciphers → check the origin's OriginSslProtocols in the distribution config.

aws cloudfront get-distribution-config --id E123ABC \
  --query "DistributionConfig.Origins.Items[].{id:Id, domain:DomainName, cfg:CustomOriginConfig}"

#3. 504: timeouts and blocked connections

• Security group on the ALB must allow CloudFront. Use the AWS-managed prefix list com.amazonaws.global.cloudfront.origin-facing:

PL=$(aws ec2 describe-managed-prefix-lists \
  --filters Name=prefix-list-name,Values=com.amazonaws.global.cloudfront.origin-facing \
  --query "PrefixLists[0].PrefixListId" --output text)
aws ec2 authorize-security-group-ingress --group-id sg-0abc --ip-permissions \
  "IpProtocol=tcp,FromPort=443,ToPort=443,PrefixListIds=[{PrefixListId=$PL}]"

• Slow origin: CloudFront's default origin response timeout is 30 seconds. Fix the slow endpoint first; raising the timeout only hides it. For known long requests, raise OriginReadTimeout in the origin config.
• Origin down: check ALB target health. If all targets are unhealthy, see the ALB 503 runbook.

#4. 403 from S3 origins

With Origin Access Control the bucket policy must allow the CloudFront service principal for this distribution:

{
  "Effect": "Allow",
  "Principal": { "Service": "cloudfront.amazonaws.com" },
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-site-bucket/*",
  "Condition": { "StringEquals": { "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/E123ABC" } }
}

A recreated distribution has a new ARN; the old condition no longer matches. KMS-encrypted objects also need the key policy to allow CloudFront to decrypt.

#5. Use logs to confirm

If standard logs or real-time logs are on, filter for errors by x-edge-result-type and x-edge-detailed-result-type; values such as OriginConnectError, OriginDnsError and OriginReadTimeout point straight at the cause (exact values vary; check the CloudFront log documentation).

#6. Recover and purge

After fixing the origin, errors may be cached for the error caching minimum TTL (default 10 seconds, often raised). Invalidate if needed:

aws cloudfront create-invalidation --distribution-id E123ABC --paths "/*"

#Prevent it next time

• Use ACM certificates on origins so renewals are automatic.
• Alarm on CloudFront 5xxErrorRate and origin latency in us-east-1 metrics.
• Keep the distribution config in IaC; review origin and behaviour changes.
• Configure origin failover groups for critical sites.