CloudFront 403 Error: The Request Could Not Be Satisfied

How to fix it

Try these in order — the most common fix is first.

1. 1. Fix S3 access with OAC

   Copy steps
   1. CloudFront > Origins > edit > Origin access control
   2. Copy the generated bucket policy into S3 > Permissions > Bucket policy (principal cloudfront.amazonaws.com, condition AWS:SourceArn = your distribution)
   3. S3 website endpoints don't support OAC
   Did this fix it? Yes No

2. 2. Set the default root object

   1. Distribution > General > Settings > Default root object: index.html
   Did this fix it? Yes No

3. 3. Check domain and certificate

   Copy steps
   1. Add the hostname to Alternate domain names
   2. Certificate must be in us-east-1 and cover the name; DNS must point to the distribution
   Did this fix it? Yes No

4. 4. Check restrictions

   Copy steps
   1. Security > geographic restrictions
   2. WAF sampled requests; switch the rule to Count while testing
   3. Signed URL expiry, key group
   Did this fix it? Yes No

5. 5. Find who generated the error

   1. Check response headers (X-Cache, Server: AmazonS3) and enable logging
   Did this fix it? Yes No

Symptoms

Browser shows 403 ERROR 'The request could not be satisfied' or an S3 AccessDenied XML.

Why it happens

• S3 bucket policy doesn't allow the distribution (OAC/OAI)
• No default root object
• Request hostname not in Alternate domain names (CNAMEs)
• Object missing and no s3:ListBucket permission
• Geo restriction
• AWS WAF rule blocking
• Invalid or expired signed URL/cookie

This guide also covers

• cloudfront 403 error
• cloudfront the request could not be satisfied
• cloudfront s3 access denied
• cloudfront 403 forbidden

The same problem in other apps

All not loading, error messages & connection guides →

• DigitalOcean Droplet SSH Connection Refused or Timed Out (DigitalOcean)
• Vercel FUNCTION_INVOCATION_TIMEOUT (504) Error (Vercel)

Other AWS errors

• AWS Unexpected Charges: Why Is My AWS Bill So High?
• AWS Charges After Free Tier: Why Am I Being Billed?
• AWS Account Suspended: How to Reactivate It
• EC2 SSH Connection Timed Out
• EC2 SSH 'Permission denied (publickey)' and Key File Errors
• S3 Access Denied (403 Forbidden) Error
• AWS 'Not Authorized to Perform' IAM Error
• Lambda 'Task timed out after 3.00 seconds' Error