D504CO errors indicate that API Gateway failed to connect to your backend service. Each sub-error points to a specific failure mode — identify the exact message in the response, then follow the steps for that case.
Backend service connect failed 'Timeout connecting to 172.X.X.1:80'
Cause: API Gateway could not reach the backend service within the allowed time.
Solution: Check the following in order:
Verify that the backend service URL is correct.
If the backend service runs on an Elastic Compute Service (ECS) instance, check the security group rules. Add the egress IP address of API Gateway to the allowlist so the security group permits inbound traffic from API Gateway.
Check whether the backend service has a whitelist or blacklist that blocks API Gateway, whether the backend application is running, and whether a firewall on the backend server is rejecting connections from API Gateway.
If the backend service is in a virtual private cloud (VPC) and traffic crosses regions or comes from an on-premises data center over Cloud Enterprise Network (CEN), configure the return route. For details, see Access to cloud services.
Backend service connect failed 'Connection is closed'
Cause: The backend service sent a FIN packet to close the connection before API Gateway finished processing the request.
Solution: This issue was resolved in August 2023. API Gateway now automatically retries the connection when it receives a FIN packet from the backend service. If your dedicated instance was purchased before August 2023, submit a ticket to have the instance updated to the fixed version.
Backend service connect failed 'Connection refused'
Cause: The backend service actively rejected the connection request from API Gateway.
Solution: Check your backend service configuration and logs to identify why connections are being refused.
Backend service connect failed 'Connection lease request time out'
Cause: API Gateway exhausted all available connections in its outbound connection pool before a connection could be assigned to the request.
Solution: Upgrade your API Gateway instance to one with a larger connection pool. For available instance types and their connection pool sizes, see Instance types.
HTTP persistent connections transmit data serially: the sender must wait for each request to be acknowledged before sending the next. Plan your outbound connection pool size based on your backend response time and expected RPS (requests per second).
For example, an api.s1.small instance has a connection pool of 1,200 connections. If your backend takes one second to respond per request, this instance supports up to 1,200 outbound RPS. Requests that exceed this limit wait in a queue for up to 500 milliseconds. If a queued request cannot be dispatched within that window, API Gateway returns the Connection lease request time out error to the client.