# 403 on cloudfront

**URL:** <https://discourse.crowdsec.net/t/403-on-cloudfront/1704>\
**Category:** crowdsec\
**Created:** [March 19, 2024, 10:23am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704 "2024-03-19T10:23:16Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [March 19, 2024, 10:23am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/1 "2024-03-19T10:23:16Z")

</div>

Trying to install crowdsec by container I fail at the first start with a 403

`Mar 19 11:16:52 R1-pve.rocky9-pve.org crowdsec1[27844]: time="19-03-2024 10:16:52" level=fatal msg="Failed to get Hub index : failed to download index: bad http code 403 while requesting https://hub-cdn.crowdsec.net/v1.5.4/.index.json"`

I think that it is recent, do you have some issue on cloudfront, if I go myself to the URL indeed I have a 403 from cloudfront

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [March 19, 2024, 10:27am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/2 "2024-03-19T10:27:45Z")

</div>

fixed thanks

[https://hub-cdn.crowdsec.net/v1.5.4/.index.json](https://hub-cdn.crowdsec.net/v1.5.4/.index.json)

---

<div class="post-metadata">

**Author:** ![anthonyra](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/anthonyra/32/831_2.png) [@anthonyra](https://discourse.crowdsec.net/u/anthonyra)\
**Post date:** [March 27, 2024, 10:05am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/3 "2024-03-27T10:05:36Z")

</div>

```auto
FATA[2024-03-26T16:42:06Z] failed to update hub: bad http code 403 for https://hub-cdn.crowdsec.net/master/.index.json 
dpkg: error processing package crowdsec (--configure):
 installed crowdsec package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 crowdsec
needrestart is being skipped since dpkg has failed
E: Sub-process /usr/bin/dpkg returned an error code (1)

```

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 27, 2024, 10:07am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/4 "2024-03-27T10:07:41Z")

</div>

We have a rate limits on the hub cloudfront address do you have any other deployments using the same IP address?

---

<div class="post-metadata">

**Author:** ![anthonyra](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/anthonyra/32/831_2.png) [@anthonyra](https://discourse.crowdsec.net/u/anthonyra)\
**Post date:** [March 27, 2024, 3:53pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/5 "2024-03-27T15:53:58Z")

</div>

I’m deploying VM’s in a cluster under the same IP address. Rate limiting is probably what happened. But I would have expected a 429 error and not 403? Is there any details on the rate limit?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 27, 2024, 3:58pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/6 "2024-03-27T15:58:49Z")

</div>

Cloudfront doesnt handle the response, the response comes from AWS WAF which only has a 403 response code option.

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [March 28, 2024, 8:10am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/7 "2024-03-28T08:10:53Z")

</div>

I am a developer and an integrator, so I could have some works and some instances running, however the level is really low if it is this reason to trigger a limit

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [March 28, 2024, 10:47am UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/8 "2024-03-28T10:47:14Z")

</div>

Hello,

We’re trying to deal with some broken setups that keep downloading hub files in a loop, leading to unwanted infrastructure load & cost. We’re looking to lighten the scenarios a bit not to impact legit users managing clusters exiting through the same IP, while looking for a more long-term solution.

Thanks for your patience 🙂

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [April 9, 2024, 12:23pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/9 "2024-04-09T12:23:22Z")

</div>

```auto
Apr 09 14:20:37 R2-pve.rocky9-pve2.org agent@crowdsec1[8111]: Running: cscli parsers install "crowdsecurity/docker-logs"
Apr 09 14:20:38 R2-pve.rocky9-pve2.org agent@crowdsec1[8111]: time="2024-04-09T12:20:38Z" level=fatal msg="error while installing 'crowdsecurity/docker-logs': while downloading crowdsecurity/docker-logs: bad http code 403"

```

Got this today, I do not know if it is related

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [April 9, 2024, 12:29pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/10 "2024-04-09T12:29:53Z")

</div>

related @iiAmLoz @thibault

```auto
╰─➤ curl -k https://hub-cdn.crowdsec.net/v1.5.4/.index.json 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Request blocked.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: sw8e-Y-Z8Efp2Ft0ectnBFaF9V5ifUWOI_8M1CnuuEgmhbPx0Z6fQw==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>%

```

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [April 9, 2024, 12:32pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/11 "2024-04-09T12:32:04Z")

</div>

Hey I can see you also posted in discord can you reach out to me in DM’s im under the same name

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [April 9, 2024, 2:19pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/12 "2024-04-09T14:19:56Z")

</div>

honestly, I do not like discord…and login to read is so boring, I love open talk in an open world

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [April 9, 2024, 2:24pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/13 "2024-04-09T14:24:48Z")

</div>

> [@stephdl](#):
>
> `curl -k https://hub-cdn.crowdsec.net/v1.5.4/.index.json`

I can confirm it is my external ip that is blocked 😛

When I go to tethering I can do the curl CLI

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [April 9, 2024, 3:06pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/14 "2024-04-09T15:06:07Z")

</div>

All good open world is fine too, sometimes I forget to look outside 😆

To update this thread with the information, the user IP address was blocked due to excessive download of the geo ip database. So if you are running individual nodes this may happen, if you are on a cluster and can share the data volume this would be best.

---

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [April 10, 2024, 1:02pm UTC](https://discourse.crowdsec.net/t/403-on-cloudfront/1704/15 "2024-04-10T13:02:25Z")

</div>

yep will try, to be honest I was working to validate some UI properties, I do triggered plenty of time the services and I might have installed some crowdsec instances but I do not think it was abused (from my point of view of course)

each crowdsec container mounts its data under a volume

> <https://github.com/NethServer/ns8-crowdsec/blob/976e19cd3f3b6a5e8235f4543ff456dfcb613f4c/imageroot/crowdsec.service#L39>