CloudWatch Metric Guide

AWS/CloudFront/4xxErrorRatePercent

4xxErrorRateAmazon CloudFront CloudWatch metric

4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.

What it measures

About 4xxErrorRate

4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.

NamespaceAWS/CloudFront
Metric name4xxErrorRate
UnitPercent
AWS docsOfficial Amazon CloudFront metrics reference

Why this metric matters

4xxErrorRate is noisier and generally less urgent than 5xxErrorRate — some baseline level of 404s and 403s is normal for any public-facing distribution — but a sudden step-change is a strong signal of a specific, fixable regression: a deploy that removed or renamed static assets, signed URLs or signed cookies that expired or were generated with the wrong key, or a WAF rule that started blocking legitimate traffic after a rule-set update.

Because 4xxErrorRate aggregates every code from 400 to 499 into one number, use it as a first-alert trigger, then drill into CloudFront's per-status-code error rate metrics (401ErrorRate, 403ErrorRate, 404ErrorRate) — available only after turning on CloudFront's additional distribution metrics — to identify which specific failure mode is spiking. Like all CloudFront metrics, this one is only queryable from the CloudWatch us-east-1 endpoint with Region=Global set, independent of where the distribution's traffic actually originates.

Recommended alarm threshold for 4xxErrorRate

Recommended threshold

> 5% sustained for 3 consecutive 5-minute periods (Average statistic)

AWS does not publish a recommended threshold for 4xxErrorRate. The 5% floor (Nuberio recommendation) is set higher than the 5xxErrorRate threshold because a healthy site typically carries some background 404/403 traffic from bots, stale bookmarks, and crawlers; 5% sustained is well above that noise floor and reliably correlates with an actual regression such as a broken deploy or an over-aggressive WAF rule.

Is your 4xxErrorRate alarm already set up correctly?

The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured alarms — including 4xxErrorRate — in 5 minutes.

Run a free audit →

Common failures that show up in 4xxErrorRate

When 4xxErrorRate reaches an alarm threshold, these are the most common root causes — in order of how often Nuberio sees them across customer AWS accounts.

  • Broken deploy — a release removes or renames static assets that clients still request, producing a wave of 404s

  • Expired or misconfigured signed URLs/signed cookies — clients present credentials CloudFront now rejects with 403

  • WAF rule update starts blocking legitimate traffic patterns, returning 403 for real users

  • API contract change on the origin causes previously valid client requests to be rejected as malformed (400)

  • Client-side routing bug sends requests to paths that no longer exist on the origin

How the Nuberio Audit checks 4xxErrorRate

The free Audit scans every Amazon CloudFront resource in your account and checks whether a 4xxErrorRate alarm exists, whether its threshold and evaluation period are configured sensibly, and flags it if it's missing entirely. Every finding comes with the exact CLI command to fix it — read-only access, no credit card, results in about 5 minutes.

Nuberio Audit

Scans your CloudWatch setup for missing or misconfigured 4xxErrorRate alarms. Free, 5-minute read-only scan.

Run a free audit →

Related Amazon CloudFront metrics

4xxErrorRate rarely fails in isolation. These metrics tend to correlate — monitor them together for complete Amazon CloudFront coverage.

FAQ

Frequently asked questions about 4xxErrorRate

Common questions about setting up CloudWatch alarms for 4xxErrorRate in Amazon CloudFront.

What is the recommended CloudWatch alarm threshold for 4xxErrorRate?+

> 5% sustained for 3 consecutive 5-minute periods (Average statistic). AWS does not publish a recommended threshold for 4xxErrorRate. The 5% floor (Nuberio recommendation) is set higher than the 5xxErrorRate threshold because a healthy site typically carries some background 404/403 traffic from bots, stale bookmarks, and crawlers; 5% sustained is well above that noise floor and reliably correlates with an actual regression such as a broken deploy or an over-aggressive WAF rule.

Which CloudWatch namespace does 4xxErrorRate belong to?+

4xxErrorRate is published in the AWS/CloudFront namespace with a unit of Percent. You can find it in the CloudWatch console under "Metrics" → "AWS/CloudFront". See the Amazon CloudFront CloudWatch metrics reference in the AWS documentation.

Does Nuberio automatically create CloudWatch alarms for 4xxErrorRate?+

No — the free Nuberio Audit does not create alarms for you. It scans your CloudWatch setup and tells you which Amazon CloudFront resources are missing a 4xxErrorRate alarm, then gives you the exact CLI command to create it yourself.

Can I use Nuberio without already having a 4xxErrorRate alarm set up?+

Yes. The free Audit works whether or not you have any 4xxErrorRate alarm configured — it reads the resource directly from CloudWatch and tells you which resources need one, plus the copy-paste AWS CLI command to create it.

This page is part of the CloudWatch metric guide — thresholds and debugging guidance for every metric across RDS, Lambda, ECS, ALB, EC2, and DynamoDB. To find which Amazon CloudFront alarms your account is missing — including 4xxErrorRate — run the free CloudWatch alarm audit. The scan takes under 5 minutes and requires no account.