In short. CloudFront applies a 1-second minimum to cached errors from an S3 bucket origin when the configured minimum is zero.
Definition: No. For a CloudFront distribution with caching enabled for an S3 bucket origin, setting Error Caching Minimum TTL to 0 seconds still produces an error caching minimum TTL of 1 second for S3 origin errors. AWS documents this floor as protection for the origin against DDoS attacks.
Key facts
- CloudFront's error caching documentation says that a configured value of 0 seconds still results in 1 second for S3 origin errors.
- The same guide says CloudFront normally caches error responses for a default duration of 10 seconds, then sends the next request to the origin.
- The CloudFront CustomErrorResponse API reference defines ErrorCachingMinTTL as the minimum time, in seconds, that CloudFront caches the status named by ErrorCode.
- The S3-specific 1-second rule does not apply to other origin types, according to the error caching guide.
What does a zero setting mean for an S3 origin?
Error Caching Minimum TTL is the per-status-code duration CloudFront uses for cached 4xx and 5xx responses. A zero entered in the distribution configuration therefore expresses the shortest configured duration. The AWS guide applies a separate minimum when the origin is an S3 bucket with caching enabled: the effective minimum for an S3 origin error remains 1 second.
Configured Error Caching Minimum TTL: 0 seconds
Effective minimum for an S3 origin error: 1 second
AWS gives the reason in the same paragraph: CloudFront applies the floor to protect the origin from DDoS attacks. The documented exception is limited to S3 origin errors. The page does not extend the 1-second floor to other origin types.
How does CloudFront use the error caching duration?
When an origin returns an error for an object, CloudFront serves either the error response or a configured custom error page until the error caching duration expires. After that period, it submits another request to the origin to check whether the problem has been resolved and the object is available. The API reference describes the same transition as CloudFront querying the origin after the ErrorCachingMinTTL period.
A shorter duration causes CloudFront to forward more requests to the origin. AWS warns that this can aggravate the problem that caused a 5xx error. A longer duration can leave the error response or custom page in use after the object is available again.
The setting concerns the status code named by ErrorCode in a CustomErrorResponse object. It does not make every response uncacheable. CloudFront does not cache status code 416 responses, even when a value is supplied for that status code.
Can response headers change the result?
CloudFront can use response headers from the origin when calculating an error response's cache time. With Cache-Control: max-age, Cache-Control: s-maxage, or an Expires header, it uses the greater of the header value and Error Caching Minimum TTL. A Cache-Control: no-store, no-cache, or private directive suppresses caching for error codes 404, 410, 414, and 501. For other error codes, CloudFront ignores those directives and uses Error Caching Minimum TTL.
The S3 rule still matters when the configured minimum is zero. The documentation describes the 1-second S3 floor after describing these header rules, and says that it applies to S3 origin errors.
FAQ
Does a zero value make CloudFront query S3 on every request?
No. The documented S3 minimum is 1 second, so zero does not remove the minimum interval for S3 origin errors. The next origin request occurs after the error caching period has elapsed.
Can an invalidation remove a cached error sooner?
Yes. AWS says you can invalidate a cached error code with the URL of the requested object when its expiration time is longer than wanted. If several objects return errors, each object must be invalidated separately.
Related terms
- Why can CloudFront keep returning an error after the origin page is fixed?
- How does CloudFront combine origin cache headers with error cache settings?
- Can CloudFront return a successful status for an origin error page?
Sources
- Amazon CloudFront, "Control how long CloudFront caches errors", undated
- Amazon CloudFront, "CustomErrorResponse", undated
Check how a page reads to answer engines. Open the GEO score analyzer