CODEWITHSUNDEEP
amazon-s3amazon-cloudfronthttp-status-code-403invalidation
Gil
Gil

Reputation: 41

Cloudfront - cannot invalidate objects that used to return 403

The setting

I have an Amazon Cloudfront distribution that was originally set as secured. Objects in this distribution required a URL signing. For example, a valid URL used to be of the following format:

https://d1stsppuecoabc.cloudfront.net/images/TheImage.jpg?Expires=1413119282&Signature=NLLRTVVmzyTEzhm-ugpRymi~nM2v97vxoZV5K9sCd4d7~PhgWINoTUVBElkWehIWqLMIAq0S2HWU9ak5XIwNN9B57mwWlsuOleB~XBN1A-5kzwLr7pSM5UzGn4zn6GRiH-qb2zEoE2Fz9MnD9Zc5nMoh2XXwawMvWG7EYInK1m~X9LXfDvNaOO5iY7xY4HyIS-Q~xYHWUnt0TgcHJ8cE9xrSiwP1qX3B8lEUtMkvVbyLw__&Key-Pair-Id=APKAI7F5R77FFNFWGABC

The distribution points to an S3 bucket that also used to be secured (it only allowed access through the cloudfront).

What happened

At some point, the URL singing expired and would return a 403.

Since we no longer need to keep the same security level, I recently changed the setting of the cloudfront distribution and of the S3 bucket it is pointing to, both to be public.

I then tried to invalidate objects in this distribution. Invalidation did not throw any errors, however the invalidation did not seem to succeed. Requests to the same cloudfront URL (with or without the query string) still return 403.

The response header looks like:

HTTP/1.1 403 Forbidden
Server: CloudFront
Date: Mon, 18 Aug 2014 15:16:08 GMT
Content-Type: text/xml
Content-Length: 110
Connection: keep-alive
X-Cache: Error from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f04a0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: j1CszSXz0DO-IxFvHWyqkDSdO462LwkfLY0muRDrULU7zT_W4HuZ2B==

Things I tried

I tried to set another cloudfront distribution that points to the same S3 as origin server. Requests to the same object in the new distribution were successful.

The question

Did anyone encounter the same situation where a cloudfront URL that returns 403 cannot be invalidated? Is there any reason why wouldn't the object get invalidated?

Thanks for your help!

Upvotes: 4

Views: 2054

Answers (1)

Tej Kiran
Tej Kiran

Reputation: 2248

  1. First check that Invalidation is not in progress. If it is then wait till it is completed.
  2. If you are accessing S3 Object through CloudFront using Public URL then you need to have public read permission on that S3 Object.
  3. If you are trying to access S3 Object through CloudFront using Signed URL then make sure that time that are mention while generating sign url, must be greater then current time.

Upvotes: 1

Related Questions