CloudWatch Metric Guide
5xxErrorRateAmazon CloudFront CloudWatch metric
5xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 5xx range, indicating a server-side error at the origin or within CloudFront itself.
What it measures
About 5xxErrorRate
5xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 5xx range, indicating a server-side error at the origin or within CloudFront itself.
| Namespace | AWS/CloudFront |
| Metric name | 5xxErrorRate |
| Unit | Percent |
| AWS docs | Official Amazon CloudFront metrics reference |
Why this metric matters
A rising 5xxErrorRate is CloudFront reporting that your origin — or a Lambda@Edge/CloudFront Function attached to the distribution — is failing to serve requests correctly. Because CloudFront sits in front of the origin for every viewer, a spike here affects every user hitting that content simultaneously, unlike an origin-side metric that might only reflect load on one instance. This makes 5xxErrorRate one of the fastest, clearest external signals that something is wrong with the backend behind the CDN.
This is a default distribution metric available at no additional cost — unlike OriginLatency and CacheHitRate, you do not need to enable CloudFront's additional metrics subscription to alarm on it. As with all CloudFront metrics, it is only queryable from the CloudWatch us-east-1 API endpoint with the Region=Global dimension set, regardless of your distribution's actual traffic footprint.
Recommended alarm threshold for 5xxErrorRate
Recommended threshold
> 1% sustained for 3 consecutive 5-minute periods (Average statistic)
AWS documentation does not publish a recommended alarm threshold for 5xxErrorRate. The 1%-sustained-for-15-minutes threshold (Nuberio recommendation) reflects that even a small percentage of 5xx responses at CDN scale represents a real, currently-failing origin — brief single-datapoint blips during origin deploys or auto-scaling events are common and shouldn't page on their own, which is why the alarm requires 3 consecutive breaching periods rather than 1.
Is your 5xxErrorRate alarm already set up correctly?
The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured alarms — including 5xxErrorRate — in 5 minutes.
Common failures that show up in 5xxErrorRate
When 5xxErrorRate reaches an alarm threshold, these are the most common root causes — in order of how often Nuberio sees them across customer AWS accounts.
Origin server overload or crash — the backend behind CloudFront can't keep up with forwarded request volume
Origin misconfiguration — wrong protocol, port, or origin path set on the distribution, or origin failover pointing at a dead endpoint
Origin SSL/TLS certificate expired or invalid, causing CloudFront to fail the handshake with a 502/504
Lambda@Edge or CloudFront Functions error or timeout attached to the distribution's cache behavior
Origin-side deployment or database outage that returns 500-range errors CloudFront simply passes through
How the Nuberio Audit checks 5xxErrorRate
The free Audit scans every Amazon CloudFront resource in your account and checks whether a 5xxErrorRate alarm exists, whether its threshold and evaluation period are configured sensibly, and flags it if it's missing entirely. Every finding comes with the exact CLI command to fix it — read-only access, no credit card, results in about 5 minutes.
Nuberio Audit
Scans your CloudWatch setup for missing or misconfigured 5xxErrorRate alarms. Free, 5-minute read-only scan.
Related Amazon CloudFront metrics
5xxErrorRate rarely fails in isolation. These metrics tend to correlate — monitor them together for complete Amazon CloudFront coverage.
FAQ
Frequently asked questions about 5xxErrorRate
Common questions about setting up CloudWatch alarms for 5xxErrorRate in Amazon CloudFront.
What is the recommended CloudWatch alarm threshold for 5xxErrorRate?+
> 1% sustained for 3 consecutive 5-minute periods (Average statistic). AWS documentation does not publish a recommended alarm threshold for 5xxErrorRate. The 1%-sustained-for-15-minutes threshold (Nuberio recommendation) reflects that even a small percentage of 5xx responses at CDN scale represents a real, currently-failing origin — brief single-datapoint blips during origin deploys or auto-scaling events are common and shouldn't page on their own, which is why the alarm requires 3 consecutive breaching periods rather than 1.
Which CloudWatch namespace does 5xxErrorRate belong to?+
5xxErrorRate is published in the AWS/CloudFront namespace with a unit of Percent. You can find it in the CloudWatch console under "Metrics" → "AWS/CloudFront". See the Amazon CloudFront CloudWatch metrics reference in the AWS documentation.
Does Nuberio automatically create CloudWatch alarms for 5xxErrorRate?+
No — the free Nuberio Audit does not create alarms for you. It scans your CloudWatch setup and tells you which Amazon CloudFront resources are missing a 5xxErrorRate alarm, then gives you the exact CLI command to create it yourself.
Can I use Nuberio without already having a 5xxErrorRate alarm set up?+
Yes. The free Audit works whether or not you have any 5xxErrorRate alarm configured — it reads the resource directly from CloudWatch and tells you which resources need one, plus the copy-paste AWS CLI command to create it.
This page is part of the CloudWatch metric guide — thresholds and debugging guidance for every metric across RDS, Lambda, ECS, ALB, EC2, and DynamoDB. To find which Amazon CloudFront alarms your account is missing — including 5xxErrorRate — run the free CloudWatch alarm audit. The scan takes under 5 minutes and requires no account.