{
  "id": 17831960,
  "title": "CloudFront VPC Origin returns 504? Your origin's security group is lying to you",
  "url": "https://urgent.news/2026/11/02/cloudfront-vpc-origin-returns-504-your-origins-security-group-is",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T17:54:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/esthernnolum/cloudfront-vpc-origin-returns-504-your-origins-security-group-is-lying-to-you-l23"
  },
  "original_language": "en",
  "account": "When building a private-edge architecture on AWS with CloudFront, a Network Load Balancer, and no public load balancer, a 504 Gateway Timeout error can occur. The issue lies in the security group of the Network Load Balancer, which incorrectly limits inbound traffic to the VPC CIDR range. CloudFront VPC origins connect to the origin from CloudFront's public, origin-facing IP ranges, not from within the VPC. Therefore, the security group should allow traffic from CloudFront's public origin-facing IP ranges, which can be done by referencing the managed prefix list \"com.amazonaws.global.cloudfront.origin-facing\" instead of the VPC CIDR range. Once this change is applied, the CloudFront VPC origin should function correctly, and the 504 Gateway Timeout error will be resolved.",
  "summary": "I built a clean private-ingress edge on AWS: CloudFront out front for TLS, WAF, and Shield; a private Network Load Balancer as the origin; no public load balancer anywhere. Everything provisioned without error. Then the first request came back 504 Gateway Timeout . The fix was a single security-group rule. The reason is a mental model about CloudFront VPC origins that's easy to get wrong, so it's…",
  "key_points": [
    "CloudFront VPC Origin returns 504 Gateway Timeout error",
    "Security group of Network Load Balancer limits inbound traffic",
    "Allow traffic from CloudFront's public origin-facing IP ranges"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}