DocumentationExperience Cloud KCS

Resolving 403 and 421 errors with AWS CloudFront and custom domains

Last update: August 28, 2026

This article describes how to resolve HTTP 403 and 421 errors that occur when connecting AWS CloudFront to the Adobe Experience Manager publish tier with a custom domain and IP allow list.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service (AEMaaCS) (all versions)
  • AWS CloudFront as a CDN in front of the AEM publish tier

Symptoms

  • Requests to the staging or custom domain pointing to the AEM publish tier return HTTP 403 Forbidden errors.
  • HTTP 421 Misdirected Request errors can also occur.
  • The issue occurs after following the documented setup steps for custom domain names with a customer-managed CDN.
  • The issue is resolved when the IP allow list in Cloud Manager is set to allow all (0.0.0.0/0).

Cause

The 403 and 421 errors occur because the IP allow list configuration blocks traffic from the CDN to the publish tier. Updating the allow list to include the CDN’s edge IP ranges resolves the issue.

Resolution resolution

Follow these steps to resolve the issue:

  1. Review the IP allow list configuration in Cloud Manager for the publish tier.
  2. If the IP allow list is enabled and does not include the CloudFront or CDN edge IP ranges, update the allow list to include the IP ranges used by your CDN provider, such as AWS CloudFront.
  3. Refer to your CDN provider’s documentation for the current list of edge IP addresses.
  4. After you update the IP allow list, verify that requests to the custom domain succeed and no longer return 403 or 421 errors.
  5. Confirm that Edge Key authentication is enforced as described in the CDN HTTP Header Validation documentation to ensure that only requests with the correct credentials can access the publish tier.
  6. Verify that direct access to the publish host domain without the required Edge Key is denied as expected.

Note: Allowing all IP addresses in the Cloud Manager IP allow list can help confirm the source of the issue during troubleshooting, but you should restrict access to trusted CDN edge IP ranges in production.

recommendation-more-help
experience-cloud-kcs-help-kbarticles