CloudWatch Metric Guide
4xxErrorRateAmazon CloudFront CloudWatch metric
4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.
What it measures
About 4xxErrorRate
4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.
| Namespace | AWS/CloudFront |
| Metric name | 4xxErrorRate |
| Unit | Percent |
| AWS docs | Official Amazon CloudFront metrics reference |
Why this metric matters
4xxErrorRate is noisier and generally less urgent than 5xxErrorRate — some baseline level of 404s and 403s is normal for any public-facing distribution — but a sudden step-change is a strong signal of a specific, fixable regression: a deploy that removed or renamed static assets, signed URLs or signed cookies that expired or were generated with the wrong key, or a WAF rule that started blocking legitimate traffic after a rule-set update.
Because 4xxErrorRate aggregates every code from 400 to 499 into one number, use it as a first-alert trigger, then drill into CloudFront's per-status-code error rate metrics (401ErrorRate, 403ErrorRate, 404ErrorRate) — available only after turning on CloudFront's additional distribution metrics — to identify which specific failure mode is spiking. Like all CloudFront metrics, this one is only queryable from the CloudWatch us-east-1 endpoint with Region=Global set, independent of where the distribution's traffic actually originates.
Recommended alarm threshold for 4xxErrorRate
Recommended threshold
> 5% sustained for 3 consecutive 5-minute periods (Average statistic)
AWS does not publish a recommended threshold for 4xxErrorRate. The 5% floor (Nuberio recommendation) is set higher than the 5xxErrorRate threshold because a healthy site typically carries some background 404/403 traffic from bots, stale bookmarks, and crawlers; 5% sustained is well above that noise floor and reliably correlates with an actual regression such as a broken deploy or an over-aggressive WAF rule.
Is your 4xxErrorRate alarm already set up correctly?
The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured alarms — including 4xxErrorRate — in 5 minutes.
Common failures that show up in 4xxErrorRate
When 4xxErrorRate reaches an alarm threshold, these are the most common root causes — in order of how often Nuberio sees them across customer AWS accounts.
Broken deploy — a release removes or renames static assets that clients still request, producing a wave of 404s
Expired or misconfigured signed URLs/signed cookies — clients present credentials CloudFront now rejects with 403
WAF rule update starts blocking legitimate traffic patterns, returning 403 for real users
API contract change on the origin causes previously valid client requests to be rejected as malformed (400)
Client-side routing bug sends requests to paths that no longer exist on the origin
How the Nuberio Audit checks 4xxErrorRate
The free Audit scans every Amazon CloudFront resource in your account and checks whether a 4xxErrorRate alarm exists, whether its threshold and evaluation period are configured sensibly, and flags it if it's missing entirely. Every finding comes with the exact CLI command to fix it — read-only access, no credit card, results in about 5 minutes.
Nuberio Audit
Scans your CloudWatch setup for missing or misconfigured 4xxErrorRate alarms. Free, 5-minute read-only scan.
Related Amazon CloudFront metrics
4xxErrorRate rarely fails in isolation. These metrics tend to correlate — monitor them together for complete Amazon CloudFront coverage.
FAQ
Frequently asked questions about 4xxErrorRate
Common questions about setting up CloudWatch alarms for 4xxErrorRate in Amazon CloudFront.
What is the recommended CloudWatch alarm threshold for 4xxErrorRate?+
> 5% sustained for 3 consecutive 5-minute periods (Average statistic). AWS does not publish a recommended threshold for 4xxErrorRate. The 5% floor (Nuberio recommendation) is set higher than the 5xxErrorRate threshold because a healthy site typically carries some background 404/403 traffic from bots, stale bookmarks, and crawlers; 5% sustained is well above that noise floor and reliably correlates with an actual regression such as a broken deploy or an over-aggressive WAF rule.
Which CloudWatch namespace does 4xxErrorRate belong to?+
4xxErrorRate is published in the AWS/CloudFront namespace with a unit of Percent. You can find it in the CloudWatch console under "Metrics" → "AWS/CloudFront". See the Amazon CloudFront CloudWatch metrics reference in the AWS documentation.
Does Nuberio automatically create CloudWatch alarms for 4xxErrorRate?+
No — the free Nuberio Audit does not create alarms for you. It scans your CloudWatch setup and tells you which Amazon CloudFront resources are missing a 4xxErrorRate alarm, then gives you the exact CLI command to create it yourself.
Can I use Nuberio without already having a 4xxErrorRate alarm set up?+
Yes. The free Audit works whether or not you have any 4xxErrorRate alarm configured — it reads the resource directly from CloudWatch and tells you which resources need one, plus the copy-paste AWS CLI command to create it.
This page is part of the CloudWatch metric guide — thresholds and debugging guidance for every metric across RDS, Lambda, ECS, ALB, EC2, and DynamoDB. To find which Amazon CloudFront alarms your account is missing — including 4xxErrorRate — run the free CloudWatch alarm audit. The scan takes under 5 minutes and requires no account.