Do viewer-response edge functions run on origin error responses?

Definition: A viewer-response edge function is a CloudFront Function or Lambda@Edge function attached to the stage before CloudFront returns a response to the viewer. CloudFront does not invoke that event for an origin response with HTTP status code 400 or higher.

Key facts

• AWS describes the restriction as applying to both CloudFront Functions and Lambda@Edge in its edge function restrictions.
• For viewer-response events, CloudFront skips the edge function when the origin returns HTTP status code 400 or higher.
• Lambda@Edge origin-response functions are invoked for all origin responses, including responses with status code 400 or higher, according to AWS's HTTP response guidance.

What does viewer response mean in CloudFront?

AWS's Lambda@Edge event documentation places viewer response after CloudFront receives the origin response and immediately before CloudFront returns that response to the viewer. The same page distinguishes four Lambda@Edge event positions: viewer request, origin request, origin response, and viewer response.

That sequence matters for error handling. An origin-response function receives the response when CloudFront receives it from the origin. A viewer-response function runs at the later return-to-viewer stage, subject to the status-code restriction.

What is the error-response limit?

AWS's edge function restrictions state that CloudFront does not invoke edge functions for viewer response events when the origin returns HTTP status code 400 or higher. The rule covers the viewer-response event itself, so it applies to the CloudFront Function and Lambda@Edge choices that AWS groups under edge functions.

origin status code 400 or higher -> viewer-response edge function: not invoked
origin status code 400 or higher -> Lambda@Edge origin-response function: invoked

The threshold is attached to the status returned by the origin. It is therefore a documented execution limit, rather than a statement about whether CloudFront later serves a custom error page or changes the response status.

Which function can handle an origin error response?

Lambda@Edge's origin-response event remains the documented place for processing these responses. AWS says that an origin-response function can modify the HTTP response to override what the origin returned. Its examples include changing an origin 4xx or 5xx error to an HTTP 200 response with static body content, or changing it to an HTTP 301 or HTTP 302 redirect.

The same AWS guidance says that Lambda@Edge does not expose the body returned by the origin to the origin-response trigger. A function can create a static body, remove the body by setting it to an empty value, or leave the body field unchanged so the original body is returned to the viewer. These response changes occur in the origin-response event, before the viewer-response stage described above.

Related terms

• Can CloudFront return a successful status for an origin error page?
• Why can CloudFront keep returning an error after the origin page is fixed?
• Can a CloudFront response event function change query parameters?

FAQ

Does a 4xx response reach a viewer-response function?

No. A 4xx status is at least 400, so CloudFront's documented viewer-response restriction applies.

Can Lambda@Edge process a 5xx response?

Yes. AWS documents Lambda@Edge origin-response functions as invoked for all origin responses, including an origin status of 400 or higher. A 5xx response is therefore within that documented origin-response path.

Can an origin-response function replace an error status?

Yes. AWS documents changing an origin 4xx or 5xx response to HTTP 200 with static content, or to HTTP 301 or HTTP 302 for a redirect.

Sources

1. Amazon CloudFront, "Restrictions on all edge functions", undated
2. Amazon CloudFront, "How Lambda@Edge works with requests and responses", undated
3. Amazon CloudFront, "Generate HTTP responses with Lambda@Edge", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer