s3_origin_config is a required field for aws_cloudfront_distribution

[joshuaspence]

I have the following Terraform configuration:

resource "aws_cloudfront_distribution" "test" {
  origin {
    domain_name = "${aws_s3_bucket.test.bucket}.s3.amazonaws.com"
    origin_id   = "S3"
  }

  enabled = true
  comment = "Managed by Terraform"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3"

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
  }

  price_class = "PriceClass_All"

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

Running terraform apply returns an error from the AWS API:

* aws_cloudfront_distribution.test: IllegalUpdate: The specified origin server does not exist or is not valid.
    status code: 400, request id: 3dd6a09c-0e2a-11e6-b095-2928ab975404

It seems that in order to fix the error I need to add this:

    s3_origin_config {
      origin_access_identity = ""
    }

This requirement should be documented at the very least.

[catsby]

Hey @joshuaspence – for S3 origins, it seems we "need" an S3 origin config... even if it's empty :/

I've opened #6487 to address this

[catsby]

Merged #6487

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.