title: Cloudfront - item in query string triggers 403 Forbidden from S3 origin on the same resource
body: <p>I have been debugging an issue with Cloudfront whereby specifically including the term &quot;notification&quot; in the query string of my request URL returns a 403 from S3. The two following examples exhibit this behaviour:</p>
  <p><a href="https://my.website.com/app/home?notification=THING" rel="nofollow noreferrer">https://my.website.com/app/home?notification=THING</a> - <code>403 Forbidden</code> returned by S3</p>
  <p><a href="https://my.website.com/app/home?notificatio=THING" rel="nofollow noreferrer">https://my.website.com/app/home?notificatio=THING</a>   - <code>304 Not Modified</code>, and I can access the resource(s) without issue</p>
  <p>To the extent of my testing, any content in the query string that explicitly does not include the string &quot;notification&quot; works. It's just this word in particular which is problematic.</p>
  <p>Some things to note...</p>
  <ul>
  <li>Query String Forwarding and Caching on the origin behaviour is set to &quot;Forward all, cache based on all&quot;</li>
  <li>I have a Lambda function triggering on <code>origin-request</code>, <code>origin-response</code> &amp; <code>viewer-response</code> events; this function appends <code>/index.html</code> to the request URI before forwarding to the origin.</li>
  <li>Both requests are using the same Origin Access Identity which I can verify has adequate permissions to S3 - this is proven by the second example working as expected.</li>
  </ul>
  <p>As I understand it, S3 pays no attention to forwarded query strings, however extracting the request/response data from both of the examples above clearly shows a difference in behaviour, despite the only variable being the contents of the query string (that  I can tell anyway!)</p>
  <p>Failed request:</p>
  <pre><code>{
      &quot;config&quot;: {
          &quot;distributionDomainName&quot;: &quot;&lt;redacted&gt;.cloudfront.net&quot;,
          &quot;distributionId&quot;: &quot;&lt;redacted&gt;&quot;,
          &quot;eventType&quot;: &quot;origin-response&quot;,
          &quot;requestId&quot;: &quot;&lt;redacted&gt;&quot;
      },
      &quot;request&quot;: {
          &quot;clientIp&quot;: &quot;&lt;redacted&gt;&quot;,
          &quot;headers&quot;: {
              &quot;x-forwarded-for&quot;: [
                  {
                      &quot;key&quot;: &quot;X-Forwarded-For&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;user-agent&quot;: [
                  {
                      &quot;key&quot;: &quot;User-Agent&quot;,
                      &quot;value&quot;: &quot;Amazon CloudFront&quot;
                  }
              ],
              &quot;via&quot;: [
                  {
                      &quot;key&quot;: &quot;Via&quot;,
                      &quot;value&quot;: &quot;1.1 &lt;redacted&gt;.cloudfront.net (CloudFront)&quot;
                  }
              ],
              &quot;host&quot;: [
                  {
                      &quot;key&quot;: &quot;Host&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;.s3.eu-west-1.amazonaws.com&quot;
                  }
              ]
          },
          &quot;method&quot;: &quot;GET&quot;,
          &quot;origin&quot;: {
              &quot;s3&quot;: {
                  &quot;authMethod&quot;: &quot;origin-access-identity&quot;,
                  &quot;customHeaders&quot;: {},
                  &quot;domainName&quot;: &quot;&lt;redacted&gt;.s3.eu-west-1.amazonaws.com&quot;,
                  &quot;path&quot;: &quot;&quot;,
                  &quot;region&quot;: &quot;eu-west-1&quot;
              }
          },
          &quot;querystring&quot;: &quot;notification=THING&quot;,
          &quot;uri&quot;: &quot;/app/home/index.html&quot;
      },
      &quot;response&quot;: {
          &quot;headers&quot;: {
              &quot;x-amz-request-id&quot;: [
                  {
                      &quot;key&quot;: &quot;x-amz-request-id&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;x-amz-id-2&quot;: [
                  {
                      &quot;key&quot;: &quot;x-amz-id-2&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;date&quot;: [
                  {
                      &quot;key&quot;: &quot;Date&quot;,
                      &quot;value&quot;: &quot;Tue, 15 Dec 2020 17:15:11 GMT&quot;
                  }
              ],
              &quot;server&quot;: [
                  {
                      &quot;key&quot;: &quot;Server&quot;,
                      &quot;value&quot;: &quot;AmazonS3&quot;
                  }
              ],
              &quot;content-type&quot;: [
                  {
                      &quot;key&quot;: &quot;Content-Type&quot;,
                      &quot;value&quot;: &quot;application/xml&quot;
                  }
              ],
              &quot;transfer-encoding&quot;: [
                  {
                      &quot;key&quot;: &quot;Transfer-Encoding&quot;,
                      &quot;value&quot;: &quot;chunked&quot;
                  }
              ]
          },
          &quot;status&quot;: &quot;403&quot;,
          &quot;statusDescription&quot;: &quot;Forbidden&quot;
      }
  }
  </code></pre>
  <p>Working:</p>
  <pre><code>{
      &quot;config&quot;: {
          &quot;distributionDomainName&quot;: &quot;&lt;redacted&gt;.cloudfront.net&quot;,
          &quot;distributionId&quot;: &quot;&lt;redacted&gt;&quot;,
          &quot;eventType&quot;: &quot;origin-response&quot;,
          &quot;requestId&quot;: &quot;&lt;redacted&gt;&quot;
      },
      &quot;request&quot;: {
          &quot;clientIp&quot;: &quot;&lt;redacted&gt;&quot;,
          &quot;headers&quot;: {
              &quot;if-modified-since&quot;: [
                  {
                      &quot;key&quot;: &quot;If-Modified-Since&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;if-none-match&quot;: [
                  {
                      &quot;key&quot;: &quot;If-None-Match&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;x-forwarded-for&quot;: [
                  {
                      &quot;key&quot;: &quot;X-Forwarded-For&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;user-agent&quot;: [
                  {
                      &quot;key&quot;: &quot;User-Agent&quot;,
                      &quot;value&quot;: &quot;Amazon CloudFront&quot;
                  }
              ],
              &quot;via&quot;: [
                  {
                      &quot;key&quot;: &quot;Via&quot;,
                      &quot;value&quot;: &quot;1.1 &lt;redacted&gt;.cloudfront.net (CloudFront)&quot;
                  }
              ],
              &quot;host&quot;: [
                  {
                      &quot;key&quot;: &quot;Host&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;.s3.eu-west-1.amazonaws.com&quot;
                  }
              ]
          },
          &quot;method&quot;: &quot;GET&quot;,
          &quot;origin&quot;: {
              &quot;s3&quot;: {
                  &quot;authMethod&quot;: &quot;origin-access-identity&quot;,
                  &quot;customHeaders&quot;: {},
                  &quot;domainName&quot;: &quot;&lt;redacted&gt;.s3.eu-west-1.amazonaws.com&quot;,
                  &quot;path&quot;: &quot;&quot;,
                  &quot;region&quot;: &quot;eu-west-1&quot;
              }
          },
          &quot;querystring&quot;: &quot;notificatio=THING&quot;,
          &quot;uri&quot;: &quot;/app/home/index.html&quot;
      },
      &quot;response&quot;: {
          &quot;headers&quot;: {
              &quot;x-amz-id-2&quot;: [
                  {
                      &quot;key&quot;: &quot;x-amz-id-2&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;x-amz-request-id&quot;: [
                  {
                      &quot;key&quot;: &quot;x-amz-request-id&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;date&quot;: [
                  {
                      &quot;key&quot;: &quot;Date&quot;,
                      &quot;value&quot;: &quot;Tue, 15 Dec 2020 17:17:29 GMT&quot;
                  }
              ],
              &quot;last-modified&quot;: [
                  {
                      &quot;key&quot;: &quot;Last-Modified&quot;,
                      &quot;value&quot;: &quot;Thu, 03 Dec 2020 09:14:18 GMT&quot;
                  }
              ],
              &quot;etag&quot;: [
                  {
                      &quot;key&quot;: &quot;ETag&quot;,
                      &quot;value&quot;: &quot;&lt;redacted&gt;&quot;
                  }
              ],
              &quot;cache-control&quot;: [
                  {
                      &quot;key&quot;: &quot;Cache-Control&quot;,
                      &quot;value&quot;: &quot;no-cache&quot;
                  }
              ],
              &quot;server&quot;: [
                  {
                      &quot;key&quot;: &quot;Server&quot;,
                      &quot;value&quot;: &quot;AmazonS3&quot;
                  }
              ]
          },
          &quot;status&quot;: &quot;304&quot;,
          &quot;statusDescription&quot;: &quot;Not Modified&quot;
      }
  }
  </code></pre>