CloudFront VPC Origin returns 504? Your origin's security group is lying to you
I built a clean private-ingress edge on AWS: CloudFront out front for TLS, WAF, and Shield; a private Network Load Balancer as the origin; no public load balancer anywhere. Everything provisioned without error. Then the first request came back 504 Gateway Timeout . The fix was a single security-group rule. The reason is a mental model about CloudFront VPC origins that's easy to get wrong, so it's…
When building a private-edge architecture on AWS with CloudFront, a Network Load Balancer, and no public load balancer, a 504 Gateway Timeout error can occur. The issue lies in the security group of the Network Load Balancer, which incorrectly limits inbound traffic to the VPC CIDR range. CloudFront VPC origins connect to the origin from CloudFront's public, origin-facing IP ranges, not from within the VPC.
Therefore, the security group should allow traffic from CloudFront's public origin-facing IP ranges, which can be done by referencing the managed prefix list "com.amazonaws.global.cloudfront.origin-facing" instead of the VPC CIDR range. Once this change is applied, the CloudFront VPC origin should function correctly, and the 504 Gateway Timeout error will be resolved.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
