Enable HTTP/3 on AWS CloudFront Distributions (2026)

CloudFront is actually a global CDN, not just a regional one, meaning your content is served from edge locations closest to your users worldwide.

Let’s look at a CloudFront distribution serving a static website. Here’s a snippet of its configuration:

{
    "DistributionConfig": {
        "CallerReference": "my-static-website-1678886400",
        "Aliases": {
            "Quantity": 1,
            "Items": [
                "www.example.com"
            ]
        },
        "DefaultRootObject": "index.html",
        "Origins": {
            "Quantity": 1,
            "Items": [
                {
                    "Id": "S3-my-static-website",
                    "DomainName": "my-static-website.s3.amazonaws.com",
                    "OriginPath": "",
                    "CustomHeaders": {
                        "Quantity": 0
                    },
                    "S3OriginConfig": {
                        "OriginAccessIdentity": "origin-access-identity/cloudfront/E1ABCDEFG123456"
                    }
                }
            ]
        },
        "OriginGroups": {
            "Quantity": 0
        },
        "DefaultCacheBehavior": {
            "TargetOriginId": "S3-my-static-website",
            "ForwardedValues": {
                "QueryString": false,
                "Cookies": {
                    "Forward": "none"
                },
                "Headers": {
                    "Quantity": 0
                },
                "QueryStringCacheKeys": {
                    "Quantity": 0
                }
            },
            "ViewerProtocolPolicy": "redirect-to-https",
            "MinTTL": 0,
            "AllowedMethods": {
                "Quantity": 2,
                "Items": [
                    "GET",
                    "HEAD"
                ],
                "CachedMethods": {
                    "Quantity": 2,
                    "Items": [
                        "GET",
                        "HEAD"
                    ]
                }
            },
            "SmoothStreaming": false,
            "TrustedSigners": {
                "Enabled": false,
                "Quantity": 0
            },
            "LambdaFunctionAssociations": {
                "Quantity": 0
            },
            "FieldLevelEncryptionId": "",
            "RealtimeMetricsSubscriptionConfig": {
                "RealtimeMetricsSubscriptionStatus": "Disabled"
            }
        },
        "CacheBehaviors": {
            "Quantity": 0
        },
        "CustomErrorResponses": {
            "Quantity": 0
        },
        "PriceClass": "PriceClass_100",
        "Enabled": true,
        "ViewerCertificate": {
            "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/a1b2c3d4-e5f6-7890-1234-abcdef123456",
            "SSLSupportMethod": "sni-only",
            "MinimumProtocolVersion": "TLSv1.2_2021",
            "CertificateSource": "acm"
        },
        "Logging": {
            "Enabled": false,
            "IncludeCookies": false,
            "Bucket": "",
            "Prefix": ""
        },
        "Restrictions": {
            "GeoRestriction": {
                "RestrictionType": "none",
                "Quantity": 0
            }
        },
        "HttpVersion": "http2"
    }
}

To enable HTTP/3, you need to adjust the HttpVersion field within your CloudFront DistributionConfig. Currently, it’s set to http2.

The magic happens when you change this single parameter. CloudFront automatically handles the underlying QUIC protocol negotiation and UDP port management. Your origin servers don’t need to be HTTP/3 aware; CloudFront acts as the bridge, speaking HTTP/3 to the client and HTTP/1.1 or HTTP/2 to your origin. This means you get the benefits of HTTP/3’s reduced latency and improved performance without modifying your backend infrastructure.

The key configuration you need to change is the HttpVersion field. You’ll set it to http3 to enable this protocol.

Here’s how you’d modify the DistributionConfig to enable HTTP/3:

{
    "DistributionConfig": {
        // ... other existing configurations ...
        "HttpVersion": "http3" // Changed from "http2"
        // ... other existing configurations ...
    }
}

After updating this setting, you’ll deploy the distribution change. CloudFront then advertises support for HTTP/3 on UDP port 443. When a client (like a modern web browser) connects and supports HTTP/3, the connection will be established using QUIC over UDP. If the client doesn’t support HTTP/3, CloudFront will gracefully fall back to HTTP/2 or HTTP/1.1.

The most surprising thing is that enabling HTTP/3 on CloudFront often doesn’t require changing your origin server configuration at all. CloudFront handles the protocol translation, so your backend can continue serving content over HTTP/1.1 or HTTP/2 while your users enjoy the benefits of HTTP/3.

Here’s a glimpse of what a successful HTTP/3 connection might look like in browser developer tools. Notice the protocol column showing "h3":

You can verify that HTTP/3 is enabled by checking the HttpVersion field in your distribution’s configuration using the AWS CLI:

aws cloudfront get-distribution-config --id YOUR_DISTRIBUTION_ID --query 'DistributionConfig.HttpVersion' --output text

This command will output http3 if it’s enabled.

The next logical step after enabling HTTP/3 is to configure advanced caching policies for fine-grained control over how different types of content are cached, which can further optimize performance.