What Caused the July 2026 AWS CloudFront Outage?

AWS described the root cause as "an internal constraint on the fleet that manages VPC Origin connectivity" , linked to a packet processing subsystem responsible for routing requests from CloudFront's edge locations to resources within customer VPCs . The outage was not a global CloudFront meltdown — customers using S3 origins, ALB origins via the public internet, or other origin types saw no impact . AWS engineers confirmed the system responsible for distributing routing configuration to network processors "failed to load the updated configuration data correctly" once the internal capacity limit was reached .

Scope and Duration

• Start time: 12:45 AM PDT (7:45 AM UTC / 4:45 PM JST) on July 16, 2026
• End time: 4:18 AM PDT (11:18 AM UTC / 8:18 PM JST) — total duration of roughly 3 hours 33 minutes
• AWS acknowledged the issue at 1:44 AM PDT, identified the root cause by 2:57 AM PDT, and reported full resolution by 4:18 AM PDT

Affected sites included:

• Hugging Face — Hub and dataset downloads were unavailable; the Hugging Face status page confirmed the root cause as "global Amazon Web Services outage." Hugging Face was down from ~8:30 AM to ~10:07 AM UTC .
• UK National Lottery — knocked offline .
• Japanese services — Hatena Blog, Nico Nico (Niconico), PayPay, note.com, and MyNa Portal (Japanese government digital ID system) were all disrupted .
• Morpho (DeFi protocol) — web app and API offline for about three hours .
• WIPO eHague — international intellectual property system disrupted; WIPO issued guidance extending filing deadlines due to the outage .

The outage was primarily limited to CloudFront VPC Origin configurations, but because many major sites use the common "secure-by-default" architecture of CloudFront with internal Application Load Balancers (ALBs) behind VPC Origins, the blast radius was substantial. Some systems experienced a "partial outage" pattern where static assets (served from S3) remained accessible while dynamic API calls (routed through VPC Origins) returned 504 errors .

Broader Pattern: AWS Outages and Cloud Concentration Risk

This incident is the latest in a string of high-profile AWS failures that have fueled growing concern about over-concentration of internet infrastructure on a small number of hyperscale cloud providers.

• October 20, 2025: A major AWS US-EAST-1 outage affected an estimated 70,000+ organizations, taking down services including Perplexity, Snapchat, Fortnite, Canva, Slack, Signal, PlayStation, and Ring cameras for many hours. Estimated losses exceeded $75 million per hour . The outage was caused by a DNS issue that propagated to DynamoDB and other core AWS services .
• December 24, 2025: Another AWS collapse during the holiday period .
• Ongoing frequency: AWS has seen multiple CDN/DNS-related incidents in 2025–2026, including CloudFront DNS resolution failures and Route 53 delays . A cloud service monitoring organization referred to 2025 as a record year for cloud outages .

Why this keeps happening: The internet has consolidated around AWS, Azure, and Google Cloud for compute, storage, networking, DNS, authentication, CDN, and security. AWS alone commands roughly 30% of the global cloud services market, while Azure and Google hold 20% and 13% respectively . Researchers at Iowa State University note that four core internet services — DNS, authentication, email, and security infrastructure — are now concentrated in a small number of global platforms, meaning a single provider failure cascades instantly across industries . A July 2026 analysis of cloud concentration risk points out that "a service can run in three Availability Zones and still fail because it depends on one regional control plane or one network intermediary" .

The July 2026 CloudFront outage is a textbook example of this phenomenon: it was not a broad infrastructure collapse but a single feature's control-plane capacity limit that took down dozens of unrelated services across finance, AI, gaming, and government — precisely because they all shared the same underlying AWS path for private origin delivery. As one analysis put it, "Two AWS outages in three months just validated what most CTOs were afraid to admit: single-cloud dependency is an existential risk" .