Can CloudFront return a successful status for an origin error page?

Definition: Yes. CloudFront can return a configured HTTP status code to the viewer that differs from the status received from the origin, including a 200 status with a custom error page. Its standard logs keep separate fields for the status sent to the viewer and the result type associated with the origin response.

Key facts

• Amazon CloudFront's custom error response documentation gives the example of an origin returning 500 while CloudFront returns a custom error page and 200 to the viewer.
• The configurable status codes are 200, 400, 403, 404, 405, 414, 416, 500, 501, 502, 503, and 504, according to the same documentation.
• When CloudFront changes the response status and standard logs are enabled, sc-status contains the configured viewer status, while x-edge-result-type is unchanged.
• In AWS's documented example, an origin 404 changed to viewer status 200 produces sc-status 200 and x-edge-result-type Error in the log.
• The standard logging reference defines x-edge-response-result-type as the classification immediately before CloudFront returns the response to the viewer.

How does CloudFront replace the status?

The custom error response setting applies when the origin returns an error. CloudFront can send the custom error page with a different status to the viewer. AWS documents 200 as an option alongside the error statuses 400, 403, 404, 405, 414, 416, 500, 501, 502, 503, and 504.

AWS gives two operational reasons for this setting. Some firewalls and corporate proxies intercept 4xx and 5xx responses, so substituting 200 can prevent that interception. CloudFront can also return 400 for every 4xx error or 500 for every 5xx error when distinguishing individual errors is unnecessary.

The setting changes the HTTP status delivered with the custom page. It does not rewrite the origin result type recorded by CloudFront. The documented example is:

Origin response: 404
Viewer response, sc-status: 200
x-edge-result-type: Error

Which log fields show the changed response?

sc-status is the status code of the server response. For a configured status replacement, AWS says this field contains the status code specified for the viewer. The same page documents 000 for a viewer that closes the connection before the server responds, which is a separate logging case.

x-edge-result-type describes how CloudFront classified the response after the last byte left the server. The custom error page documentation says this field is unaffected by the replacement and retains the origin response result type. x-edge-response-result-type records the classification just before the response returns to the viewer, so it is a separate field to inspect when comparing the final response stage.

CloudFront also documents x-edge-request-id as an opaque identifier for the request and says it is sent in the x-amz-cf-id response header. That value can connect a standard log record with the response observed by a client.

How can you inspect a replacement in standard logs?

The standard log field order is declared in the #Fields header. A parser should use that header for the deployed log format and then read the three response fields in their documented positions:

#Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken x-forwarded-for ssl-protocol ssl-cipher x-edge-response-result-type cs-protocol-version fle-status fle-encrypted-fields c-port time-to-first-byte x-edge-detailed-result-type sc-content-type sc-content-len sc-range-start sc-range-end

For a response replacement, compare sc-status with x-edge-result-type, then use x-edge-response-result-type to see the final response classification documented for the viewer-facing stage. The log reference applies to both standard logging v2 and standard logging legacy.

FAQ

Can CloudFront return 200 when the origin returns 404?

Yes. AWS documents a custom error page example in which the origin returns 404 and CloudFront returns 200 to the viewer. The log then contains sc-status 200 and x-edge-result-type Error.

Does a 200 sc-status prove that the origin returned 200?

No. In the documented replacement example, sc-status reflects the configured viewer status while x-edge-result-type remains Error for the origin response.

Which field identifies the viewer-facing response stage?

AWS defines x-edge-response-result-type as the classification just before CloudFront returns the response to the viewer. x-edge-result-type is the separate classification after the last byte leaves the server.

Sources

1. Amazon CloudFront, "Change response codes returned by CloudFront", undated
2. Amazon CloudFront, "Standard logging reference", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer