aws_cloudfront_distribution diffs didn't match during apply

[lussier]

Hi,

I've got an issue creating an S3 bucket, with an associated CloudFront distribution and Origin Access Identity:

aws_cloudfront_distribution.super-magic-bucket-for-terraform-bug-report: diffs didn't match during apply.

When I create these components independently I don't experience the issue.

Also, if I remove origin_access_identity from s3_origin_config in the CloudFront distribution it works fine.

Terraform Version

0.7.0

Affected Resource(s)

• aws_cloudfront_distribution

Terraform Configuration Files

variable aws_profile { default = "AAAAAA" }
variable aws_region { default = "us-east-1" }

provider "aws" {
  profile = "${var.aws_profile}"
  region = "${var.aws_region}"
}

resource "aws_s3_bucket" "super-magic-bucket-for-terraform-bug-report" {
  bucket = "super-magic-bucket-for-terraform-bug-report"
  acl = "private"
  policy = <<EOF
{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "${aws_cloudfront_origin_access_identity.super-magic-bucket-for-terraform-bug-report.iam_arn}"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::super-magic-bucket-for-terraform-bug-report/*"
        }
    ]
}
EOF
  tags {
    Name = "super-magic-bucket-for-terraform-bug-report"
  }
}

resource "aws_cloudfront_origin_access_identity" "super-magic-bucket-for-terraform-bug-report" {
  comment = "super-magic-bucket-for-terraform-bug-report"
}

resource "aws_cloudfront_distribution" "super-magic-bucket-for-terraform-bug-report" {
  origin {
    domain_name = "super-magic-bucket-for-terraform-bug-report.s3.amazonaws.com"
    origin_id   = "super-magic-bucket-for-terraform-bug-report"
    s3_origin_config {
      origin_access_identity = "${aws_cloudfront_origin_access_identity.super-magic-bucket-for-terraform-bug-report.cloudfront_access_identity_path}"
    }
  }

  enabled = true
  default_root_object = "index.html"
  price_class = "PriceClass_100"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "super-magic-bucket-for-terraform-bug-report"
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }


  restrictions {
    geo_restriction {
      restriction_type = "whitelist"
      locations = ["US", "CA"]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

Debug Output

https://gist.github.com/lussier/1474a898edff60159cc49f490120b82a

Panic Output

None

Expected Behavior

It should have:

1. Created a CloudFront Origin Access Identity.
2. Create an S3 bucket and use the abovementioned Origin Access Identity ARN inside of the S3 bucket inline policy.
3. Create a CloudFront distribution that has the S3 bucket as origin.

Steps to Reproduce

terraform apply on the provided configuration

Important Factoids

No, nothing special

[lussier]

I believe it may be a duplicate of: #6527. The symptom is similar, and I can also fix it by hardcoding the origin_access_identity.

[caquino]

This still an issue on 0.7.8, is there any workaround for it?

[bvdwiel]

Seems to still be b0rked in 0.7.10. Worked around it by manuall configuring CloudFront for now.

[mcheshier1]

Still failing in 0.7.11.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.