Error during apply of aws_cloudfront_distribution using aws_cloudfront_origin_access_identity

[hashibot]

This issue was originally opened by @billyboingo as hashicorp/terraform#15028. It was migrated here as part of the provider split. The original body of the issue is below.

---

Terraform Version

0.9.6

Affected Resource(s)

• aws_cloudfront_distribution

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

data "aws_route53_zone" "hosted_zone" {
  name = "${var.hosted_zone_name}"
}

resource "aws_cloudfront_distribution" "distribution" {
  origin {
    domain_name = "${var.bucket_domain_name}"
    origin_id   = "S3-${var.bucket_name}"

    s3_origin_config {
      origin_access_identity = "${var.origin_access_identity == "" ? "" : "origin-access-identity/cloudfront/${var.origin_access_identity}"}"
    }
  }

  enabled             = true
  is_ipv6_enabled     = true
  comment             = "Distribution for ${var.bucket_name} S3 Bucket."
  default_root_object = "${var.default_object}"

  aliases = ["${var.host_name}.${var.hosted_zone_name}"]

  price_class = "${var.price_class}"

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = false
    acm_certificate_arn            = "${module.ssl_cert.arn}"
    minimum_protocol_version       = "TLSv1"
    ssl_support_method             = "sni-only"
  }

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3-${var.bucket_name}"

    forwarded_values {
      query_string            = true
      query_string_cache_keys = ["version"]

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  cache_behavior {
    path_pattern     = "/data/*"
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3-${var.bucket_name}"
    trusted_signers  = ["self"]

    forwarded_values {
      query_string            = true
      query_string_cache_keys = ["version"]

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 60
    max_ttl                = 31536000
  }
}

resource "aws_route53_record" "dns_record" {
  zone_id = "${data.aws_route53_zone.hosted_zone.zone_id}"
  name    = "${var.host_name}.${var.hosted_zone_name}"
  type    = "A"

  alias {
    name                   = "${aws_cloudfront_distribution.distribution.domain_name}"
    zone_id                = "Z2FDTNDATAQYW2"
    evaluate_target_health = false
  }
}

Debug Output

https://gist.github.com/billyboingo/73982918f56eba123fd389113cff4455

Panic Output

Remain calm and carry on.

Expected Behavior

A new cloudfront distribution should have been created with restricted access to an S3 bucket via the origin access identity.

Actual Behavior

It blows up with the provided output.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply

Important Factoids

This looks like it could be a regression of the issue referenced below...

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

• Feature Request: AWS Resource Access Manager #6527

[ErrantConstruct]

We've been experiencing this issue anytime we rebuild our cloudfront distribution. Is there any work around other then running the same apply again?

[martinb3]

Sorry, what is the original issue? The gist linked here is gone.

[wweiss]

Sorry, the url has changed:
https://gist.github.com/wweiss/73982918f56eba123fd389113cff4455

[bflad]

Hi folks 👋 Sorry for the trouble with the aws_cloudfront_distribution resource. Since its original implementation, there were many configuration blocks that did not benefit from certain difference simplifications and arguments that were incorrectly using ordered lists instead of sets. Usually these type of implementation details surface in unexpected ways during Terraform runs as diffs didn't match during apply error in Terraform 0.11 and prior. (Aside: in Terraform 0.12 and later, these types of errors will include much better diagnostic information rather than dumping the raw differences.)

The configuration block simplifications and fixes were applied to the resource logic in version 2.0.0 of the Terraform AWS Provider, which will be releasing very shortly. Existing configurations should mostly work as they did previously, but aws_cloudfront_distribution resource updates and recreations should perform more reliably now without these errors. Since there were a large amount of varying diffs didn't match during apply reports, we are opting to close all these issues which appear to fall under this category.

We encourage everyone to file a new GitHub issue once upgraded to version 2.0.0 of the Terraform AWS Provider, should there be any further problems, so we can appropriately triage them. Thanks for your understanding and hope the upgrade is helpful. 😄

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!