Update-CFDistribution Not Updating Distribution Despite No Loud Failure #425

wdhowell84 · 2026-07-17T15:15:25Z

wdhowell84
Jul 17, 2026

I am trying to update the OriginPath for the one distribution I have in CloudFront as part of a CI/CD workflow. The S3 push works. The call to Update-CFDistribution seems to work, but the distribution is not updated when I look at the console in the AWS account. I have checked the credentials. I have checked the Distribution ID. I have checked the IAM permissions. I am splatting the parameters per the answer in #285. I checked that the ETag is being sent in the IfMatch parameter. The result from the Update-CFDistribution call ($result) is not returning a status ($result.Distribution.Status). I've tried the Verbose and WhatIf parameters to see if that gave me more information and nothing other than further showing me that the Distribution ID is correct. I am working with AWS.Tools.Cloudfront 4.1.674. Earlier in working on this I was working with 5.0.252, but that version wasn't returning my Origins as part of the DistributionConfig. The AWS AI said that was a known issue and that I should downgrade. I've talked to the AI until I'm blue in the face. I also used Copilot. Neither helped other than sending me down rabbit holes. AWS AI couldn't even give me a full list of the required parameters. The documentation wasn't accurate on that either. That's a separate gripe, though. I'm a bit at the end of what I can do. I need a direction to go down to further research the issue. Has anyone ever had this issue and know what I could check next?

param 
(
	[string]
	$DeploymentType = "dev",
	[string]
	$DeploymentUrl,
	[string]
	$DistributionID,
	[string]
	$CredentialsId,
	[string]
	$CredentialsKey
)

function Get-NextDFolder {
    param([string]$BucketName)
    
    try {
        # Get all objects and extract folder numbers
        $objects = Get-S3Object -BucketName $BucketName
        
        $folderNumbers = $objects | ForEach-Object {
            if ($_.Key -match '^d(\d+)/') {
                [int]$matches[1]
            }
        } | Sort-Object -Unique
        
        if ($folderNumbers) {
            $highest = ($folderNumbers | Measure-Object -Maximum).Maximum
            Write-Host "Found folders: $(($folderNumbers | ForEach-Object { "d$_" }) -join ', ')" -ForegroundColor Cyan
            Write-Host "Highest: d$highest" -ForegroundColor Green
            Write-Host "Next: d$($highest + 1)" -ForegroundColor Yellow
            return "d$($highest + 1)"
        } else {
            Write-Host "No d-folders found. Use d1." -ForegroundColor Yellow
            return "d1"
        }
        
    } catch {
        Write-Error "Error: $($_.Exception.Message)"
    }
}

Set-AWSCredential -AccessKey $CredentialsId -SecretKey $CredentialsKey
Set-DefaultAWSRegion -Region eu-central-1

$buckets = Get-S3Bucket
$bucket = $buckets | ? {
	$_.BucketName -inotmatch "-logs"
}

$newFolder = Get-NextDFolder -BucketName $bucket.BucketName

Write-Host "Deploying web app to S3 bucket: $($bucket.BucketName) in folder: $newFolder"
Write-S3Object -BucketName $bucket.BucketName -KeyPrefix $newFolder -Folder ".\product\build" -Recurse

Write-Host "Updating CloudFront distribution: $DistributionID to point to new deployment folder: $newFolder"

Set-DefaultAWSRegion -Region us-east-1
$distribution = Get-CFDistribution -Id $DistributionID
$etag = $AWSHistory.LastServiceResponse.ETag
$config = Get-CFDistributionConfig -Id $DistributionID

$originToUpdate = $null
$reportedQuantity = if ($null -ne $config.Origins) { $config.Origins.Quantity } else { 0 }

if ($reportedQuantity -ne 1) {
	$originsJson = $null
	try {
		$originsJson = $config.Origins | ConvertTo-Json -Depth 20 -Compress
	} catch {
		$originsJson = "<unable to serialize origins>"
	}
	throw "Expected exactly 1 origin for distribution '$DistributionID', but CloudFront reported Quantity='$reportedQuantity'. Origins='$originsJson'"
}

if ($config.Origins.Items -is [System.Array]) {
	if ($config.Origins.Items.Count -ne 1) {
		throw "Expected exactly 1 origin item, but Items count is '$($config.Origins.Items.Count)' for distribution '$DistributionID'."
	}
	$originToUpdate = $config.Origins.Items[0]
} else {
	$originToUpdate = $config.Origins.Items
}

if (-not $originToUpdate) {
		throw "Origin not found"
}

Write-Host "Current origin path: '$($originToUpdate.OriginPath)'"
$normalizedOriginPath = if ($newFolder.StartsWith("/")) { $newFolder } else { "/$newFolder" }

if ($originToUpdate.PSObject.Properties.Name -contains "OriginPath") {
    # Property exists, just update it
    $originToUpdate.OriginPath = $normalizedOriginPath
} else {
    # Property doesn't exist, add it
    $originToUpdate | Add-Member -MemberType NoteProperty -Name "OriginPath" -Value $normalizedOriginPath -Force
}

Write-Host "Updating to: '$normalizedOriginPath'"

$updateParams = @{
		Id = $DistributionID
		IfMatch = $etag
		
		# Distribution config parameters
		DistributionConfig_CallerReference = $config.CallerReference
		DistributionConfig_Comment = $config.Comment
		DistributionConfig_Enabled = $config.Enabled
		DistributionConfig_DefaultRootObject = $config.DefaultRootObject
		DistributionConfig_PriceClass = $config.PriceClass
		DistributionConfig_WebACLId = $config.WebACLId
		DistributionConfig_HttpVersion = $config.HttpVersion
		DistributionConfig_IsIPV6Enabled = $config.IsIPV6Enabled

		# Allowed Methods
		AllowedMethods_Item = $config.DefaultCacheBehavior.AllowedMethods.Items
		AllowedMethods_Quantity = $config.DefaultCacheBehavior.AllowedMethods.Quantity

		# Cached Methods
		CachedMethods_Item = $config.DefaultCacheBehavior.AllowedMethods.CachedMethods.Items
		CachedMethods_Quantity = $config.DefaultCacheBehavior.AllowedMethods.CachedMethods.Quantity

		# Lambda Function Associations
		LambdaFunctionAssociations_Item = $config.DefaultCacheBehavior.LambdaFunctionAssociations.Items
		LambdaFunctionAssociations_Quantity = $config.DefaultCacheBehavior.LambdaFunctionAssociations.Quantity
		
		# Origins
		Origins_Item = @($originToUpdate)
		Origins_Quantity = 1
		
		# Default Cache Behavior
		DefaultCacheBehavior_TargetOriginId = $config.DefaultCacheBehavior.TargetOriginId
		DefaultCacheBehavior_ViewerProtocolPolicy = $config.DefaultCacheBehavior.ViewerProtocolPolicy
		DefaultCacheBehavior_CachePolicyId = $config.DefaultCacheBehavior.CachePolicyId
		DefaultCacheBehavior_Compress = $config.DefaultCacheBehavior.Compress
		DefaultCacheBehavior_SmoothStreaming = $config.DefaultCacheBehavior.SmoothStreaming
		DefaultCacheBehavior_FieldLevelEncryptionId = $config.DefaultCacheBehavior.FieldLevelEncryptionId
		
		# Forwarded Values
		ForwardedValues_QueryString = $config.DefaultCacheBehavior.ForwardedValues.QueryString
		Cookies_Forward = $config.DefaultCacheBehavior.ForwardedValues.Cookies.Forward

		# GeoRestriction
		GeoRestriction_RestrictionType = "none"
		GeoRestriction_Quantity = 0
		GeoRestriction_Item = @()

		# Headers forwarding
		Headers_Quantity = $config.DefaultCacheBehavior.ForwardedValues.Headers.Quantity
		
		# Other required parameters
		TrustedSigners_Enabled = $config.DefaultCacheBehavior.TrustedSigners.Enabled
		TrustedSigners_Quantity = $config.DefaultCacheBehavior.TrustedSigners.Quantity
		TrustedKeyGroups_Enabled = $config.DefaultCacheBehavior.TrustedKeyGroups.Enabled
    TrustedKeyGroups_Quantity = $config.DefaultCacheBehavior.TrustedKeyGroups.Quantity
		
		# Cache Behaviors
		CacheBehaviors_Quantity = $config.CacheBehaviors.Quantity
		
		# Custom Error Responses
		CustomErrorResponses_Quantity = $config.CustomErrorResponses.Quantity
		
		# Logging
		Logging_Enabled = $config.Logging.Enabled
		Logging_IncludeCookie = $config.Logging.IncludeCookie
		Logging_Bucket = $config.Logging.Bucket
		Logging_Prefix = $config.Logging.Prefix
		
		# Aliases
		Aliases_Quantity = $config.Aliases.Quantity

		# Viewer Certificate (required)
    ViewerCertificate_CloudFrontDefaultCertificate = $config.ViewerCertificate.CloudFrontDefaultCertificate
    ViewerCertificate_MinimumProtocolVersion = $config.ViewerCertificate.MinimumProtocolVersion
    # ViewerCertificate_CertificateSource = $config.ViewerCertificate.CertificateSource
}

if ($config.Aliases.Items) {
    $updateParams.Aliases_Item = $config.Aliases.Items
}

if ($config.CacheBehaviors.Items) {
    $updateParams.CacheBehaviors_Item = $config.CacheBehaviors.Items
}

if ($config.CustomErrorResponses.Items) {
    $updateParams.CustomErrorResponses_Item = $config.CustomErrorResponses.Items
}

if ($config.DefaultCacheBehavior.ForwardedValues.Headers.Items) {
    $updateParams.Headers_Item = $config.DefaultCacheBehavior.ForwardedValues.Headers.Items
}

if ($config.DefaultCacheBehavior.TrustedSigners.Items) {
    $updateParams.TrustedSigners_Item = $config.DefaultCacheBehavior.TrustedSigners.Items
}

if ($config.DefaultCacheBehavior.TrustedKeyGroups.Items) {
    $updateParams.TrustedKeyGroups_Item = $config.DefaultCacheBehavior.TrustedKeyGroups.Items
}

if ($config.ViewerCertificate.ACMCertificateArn) {
    $updateParams.ViewerCertificate_ACMCertificateArn = $config.ViewerCertificate.ACMCertificateArn
}
if ($config.ViewerCertificate.IAMCertificateId) {
    $updateParams.ViewerCertificate_IAMCertificateId = $config.ViewerCertificate.IAMCertificateId
}
if ($config.ViewerCertificate.SSLSupportMethod) {
    $updateParams.ViewerCertificate_SSLSupportMethod = $config.ViewerCertificate.SSLSupportMethod
}

Write-Host "ETag: $etag"
Write-Host "IfMatch: $($updateParams.IfMatch)"

Write-Host "Updating CloudFront distribution..."
$result = Update-CFDistribution @updateParams -IfMatch $etag

Write-Host "Distribution updated successfully!"
Write-Host "Status: $($result.Distribution.Status)"

Answered by afroz429

Jul 17, 2026

Hi @wdhowell84,

I reproduced this on v5 (AWS.Tools.CloudFront 5.0.255). It comes down to two things, both of which work on v5. v4 is now out of support, so downgrading is not a long-term option.

1. Understand what `-Select` returns by default

-Select controls a cmdlet's output. To simplify the common case, when a response has exactly one service property (ignoring common metadata like ETag, ContentLength, HttpStatusCode) the default is that property, so you get the useful object directly, otherwise the default is * (the whole response). This explains both symptoms you hit:

Update-CFDistribution returns only Distribution, so it defaults to -Select 'Distribution' and its output is the Distri…

View full answer

afroz429 · 2026-07-17T15:47:52Z

afroz429
Jul 17, 2026
Collaborator

We will review the question and get back to you. Thanks

0 replies

afroz429 · 2026-07-17T18:07:26Z

afroz429
Jul 17, 2026
Collaborator

Hi @wdhowell84,

I reproduced this on v5 (AWS.Tools.CloudFront 5.0.255). It comes down to two things, both of which work on v5. v4 is now out of support, so downgrading is not a long-term option.

1. Understand what `-Select` returns by default

-Select controls a cmdlet's output. To simplify the common case, when a response has exactly one service property (ignoring common metadata like ETag, ContentLength, HttpStatusCode) the default is that property, so you get the useful object directly, otherwise the default is * (the whole response). This explains both symptoms you hit:

Update-CFDistribution returns only Distribution, so it defaults to -Select 'Distribution' and its output is the Distribution. Read $result.Status, not $result.Distribution.Status (that is always $null, which is likely why it looked like nothing happened).
Get-CFDistributionConfig returns only DistributionConfig, so it defaults to -Select 'DistributionConfig' and you get the config but not the ETag. -Select * returns the full response so you can read .ETag.

Check the default for any cmdlet with Get-Help <cmdlet> -Parameter Select. Here are both cases:

A cmdlet that defaults to a single property (Get-CFDistributionConfig returns only DistributionConfig):

Get-Help Get-CFDistributionConfig -Parameter Select

-Select <System.String>
    Use the -Select parameter to control the cmdlet output. The default value is 'DistributionConfig'.
    Specifying -Select '*' will result in the cmdlet returning the whole service response
    (Amazon.CloudFront.Model.GetDistributionConfigResponse). Specifying the name of a property
    of type Amazon.CloudFront.Model.GetDistributionConfigResponse will result in that property
    being returned. Specifying -Select '^ParameterName' will result in the cmdlet returning
    the selected cmdlet parameter value.

A cmdlet that defaults to * because its response has more than one property (New-CFDistribution returns both Distribution and Location). This is why $dist.Id is empty there and you need $dist.Distribution.Id:

Get-Help New-CFDistribution -Parameter Select

-Select <System.String>
    Use the -Select parameter to control the cmdlet output. The default value is '*'.
    Specifying -Select '*' will result in the cmdlet returning the whole service response
    (Amazon.CloudFront.Model.CreateDistributionResponse). Specifying the name of a property
    of type Amazon.CloudFront.Model.CreateDistributionResponse will result in that property
    being returned. Specifying -Select '^ParameterName' will result in the cmdlet returning
    the selected cmdlet parameter value.

The same information is on each cmdlet's reference page, for example Update-CFDistribution.

2. `$AWSHistory` was removed in v5, so your ETag is `$null`

$etag = $AWSHistory.LastServiceResponse.ETag   # $null on v5 -> empty IfMatch -> update rejected

$AWSHistory no longer exists in v5. Get the ETag from the response instead, using -Select *:

$response = Get-CFDistributionConfig -Id $DistributionID -Select *
$config   = $response.DistributionConfig
$etag     = $response.ETag

This is called out in the V5 migration guide: "the $AWSHistory session variable has been removed completely ... deprecated in favor of the -Select * parameter ... which can be used to return the entire service response."

Then verify the change landed

Do not treat "no error" as proof. Re-read the config after updating:

(Get-CFDistributionConfig -Id $DistributionID).Origins.Items[0].OriginPath

I could not reproduce the "Origins not returned" issue on 5.0.255 either. Get-CFDistributionConfig returned Origins.Items populated for me, so v5 should work fine for you. Please Let me know if anything else comes up.

TL;DR

Get the ETag with Get-CFDistributionConfig -Id $DistributionID -Select *, then $response.ETag. $AWSHistory was removed in v5.
Read status as $result.Status, not $result.Distribution.Status.
Check any cmdlet's default output with Get-Help <cmdlet> -Parameter Select.
Verify by re-reading the config after the update. Stay on v5; v4 is out of support.

2 replies

wdhowell84 Jul 17, 2026
Author

Thank you so much! I will come back and post the results of the changes. It may be tomorrow as I will need to update the system and make script changes while I also have competing priorities.

wdhowell84 Jul 17, 2026
Author

Ok. I updated to 5.0.255 first. Then, I made the suggested changes. It still doesn't update the OriginPath. Below is the new script:

param 
(
	[string]
	$DeploymentType = "dev",
	[string]
	$DeploymentUrl,
	[string]
	$DistributionID,
	[string]
	$CredentialsId,
	[string]
	$CredentialsKey
)

function Get-NextDFolder {
    param([string]$BucketName)
    
    try {
        # Get all objects and extract folder numbers
        $objects = Get-S3Object -BucketName $BucketName
        
        $folderNumbers = $objects | ForEach-Object {
            if ($_.Key -match '^d(\d+)/') {
                [int]$matches[1]
            }
        } | Sort-Object -Unique
        
        if ($folderNumbers) {
            $highest = ($folderNumbers | Measure-Object -Maximum).Maximum
            Write-Host "Found folders: $(($folderNumbers | ForEach-Object { "d$_" }) -join ', ')" -ForegroundColor Cyan
            Write-Host "Highest: d$highest" -ForegroundColor Green
            Write-Host "Next: d$($highest + 1)" -ForegroundColor Yellow
            return "d$($highest + 1)"
        } else {
            Write-Host "No d-folders found. Use d1." -ForegroundColor Yellow
            return "d1"
        }
        
    } catch {
        Write-Error "Error: $($_.Exception.Message)"
    }
}

# Set the AWS credentials for the session
Set-AWSCredential -AccessKey $CredentialsId -SecretKey $CredentialsKey
Set-DefaultAWSRegion -Region eu-central-1

# Grab all buckets and filter out the ones that are not for logs
# There should only be one app bucket and one log bucket
$buckets = Get-S3Bucket
$bucket = $buckets | ? {
	$_.BucketName -inotmatch "-logs"
}

# Get the latest folder
$newFolder = Get-NextDFolder -BucketName $bucket.BucketName

# Deploy the web app to the S3 bucket in the new folder
Write-Host "Deploying web app to S3 bucket: $($bucket.BucketName) in folder: $newFolder"
Write-S3Object -BucketName $bucket.BucketName -KeyPrefix $newFolder -Folder ".\product\build" -Recurse

# Move the Cloudfront distribution to the new deployment folder
Write-Host "Updating CloudFront distribution: $DistributionID to point to new deployment folder: $newFolder"

# CloudFront runs out of us-east-1 no matter where the bucket is located.
Set-DefaultAWSRegion -Region us-east-1
$distribution = Get-CFDistribution -Id $DistributionID
$configResponse = Get-CFDistributionConfig -Id $DistributionID -Select *
$config = $configResponse.DistributionConfig
$etag = $configResponse.ETag

# This deployment expects exactly one origin in CloudFront.
$originToUpdate = $null
$reportedQuantity = if ($null -ne $config.Origins) { $config.Origins.Quantity } else { 0 }

if ($reportedQuantity -ne 1) {
	$originsJson = $null
	try {
		$originsJson = $config.Origins | ConvertTo-Json -Depth 20 -Compress
	} catch {
		$originsJson = "<unable to serialize origins>"
	}
	throw "Expected exactly 1 origin for distribution '$DistributionID', but CloudFront reported Quantity='$reportedQuantity'. Origins='$originsJson'"
}

if ($config.Origins.Items -is [System.Array]) {
	if ($config.Origins.Items.Count -ne 1) {
		throw "Expected exactly 1 origin item, but Items count is '$($config.Origins.Items.Count)' for distribution '$DistributionID'."
	}
	$originToUpdate = $config.Origins.Items[0]
} else {
	$originToUpdate = $config.Origins.Items
}

if (-not $originToUpdate) {
		throw "Origin not found"
}

Write-Host "Current origin path: '$($originToUpdate.OriginPath)'"
$normalizedOriginPath = if ($newFolder.StartsWith("/")) { $newFolder } else { "/$newFolder" }

if ($originToUpdate.PSObject.Properties.Name -contains "OriginPath") {
    # Property exists, just update it
    $originToUpdate.OriginPath = $normalizedOriginPath
} else {
    # Property doesn't exist, add it
    $originToUpdate | Add-Member -MemberType NoteProperty -Name "OriginPath" -Value $normalizedOriginPath -Force
}

Write-Host "Updating to: '$normalizedOriginPath'"

# Update using individual parameters - this avoids the ambiguity
$updateParams = @{
		Id = $DistributionID
		IfMatch = $etag
		
		# Distribution config parameters
		DistributionConfig_CallerReference = $config.CallerReference
		DistributionConfig_Comment = $config.Comment
		DistributionConfig_Enabled = $config.Enabled
		DistributionConfig_DefaultRootObject = $config.DefaultRootObject
		DistributionConfig_PriceClass = $config.PriceClass
		DistributionConfig_WebACLId = $config.WebACLId
		DistributionConfig_HttpVersion = $config.HttpVersion
		DistributionConfig_IsIPV6Enabled = $config.IsIPV6Enabled

		# Allowed Methods
		AllowedMethods_Item = $config.DefaultCacheBehavior.AllowedMethods.Items
		AllowedMethods_Quantity = $config.DefaultCacheBehavior.AllowedMethods.Quantity

		# Cached Methods
		CachedMethods_Item = $config.DefaultCacheBehavior.AllowedMethods.CachedMethods.Items
		CachedMethods_Quantity = $config.DefaultCacheBehavior.AllowedMethods.CachedMethods.Quantity

		# Lambda Function Associations
		LambdaFunctionAssociations_Item = $config.DefaultCacheBehavior.LambdaFunctionAssociations.Items
		LambdaFunctionAssociations_Quantity = $config.DefaultCacheBehavior.LambdaFunctionAssociations.Quantity
		
		# Origins
		Origins_Item = @($originToUpdate)
		Origins_Quantity = 1
		
		# Default Cache Behavior
		DefaultCacheBehavior_TargetOriginId = $config.DefaultCacheBehavior.TargetOriginId
		DefaultCacheBehavior_ViewerProtocolPolicy = $config.DefaultCacheBehavior.ViewerProtocolPolicy
		DefaultCacheBehavior_CachePolicyId = $config.DefaultCacheBehavior.CachePolicyId
		DefaultCacheBehavior_Compress = $config.DefaultCacheBehavior.Compress
		DefaultCacheBehavior_SmoothStreaming = $config.DefaultCacheBehavior.SmoothStreaming
		DefaultCacheBehavior_FieldLevelEncryptionId = $config.DefaultCacheBehavior.FieldLevelEncryptionId
		
		# Forwarded Values
		ForwardedValues_QueryString = $config.DefaultCacheBehavior.ForwardedValues.QueryString
		Cookies_Forward = $config.DefaultCacheBehavior.ForwardedValues.Cookies.Forward

		# GeoRestriction
		GeoRestriction_RestrictionType = "none"
		GeoRestriction_Quantity = 0
		GeoRestriction_Item = @()

		# Headers forwarding
		Headers_Quantity = $config.DefaultCacheBehavior.ForwardedValues.Headers.Quantity
		
		# Other required parameters
		TrustedSigners_Enabled = $config.DefaultCacheBehavior.TrustedSigners.Enabled
		TrustedSigners_Quantity = $config.DefaultCacheBehavior.TrustedSigners.Quantity
		TrustedKeyGroups_Enabled = $config.DefaultCacheBehavior.TrustedKeyGroups.Enabled
    TrustedKeyGroups_Quantity = $config.DefaultCacheBehavior.TrustedKeyGroups.Quantity
		
		# Cache Behaviors
		CacheBehaviors_Quantity = $config.CacheBehaviors.Quantity
		
		# Custom Error Responses
		CustomErrorResponses_Quantity = $config.CustomErrorResponses.Quantity
		
		# Logging
		Logging_Enabled = $config.Logging.Enabled
		Logging_IncludeCookie = $config.Logging.IncludeCookie
		Logging_Bucket = $config.Logging.Bucket
		Logging_Prefix = $config.Logging.Prefix
		
		# Aliases
		Aliases_Quantity = $config.Aliases.Quantity

		# Viewer Certificate (required)
    ViewerCertificate_CloudFrontDefaultCertificate = $config.ViewerCertificate.CloudFrontDefaultCertificate
    ViewerCertificate_MinimumProtocolVersion = $config.ViewerCertificate.MinimumProtocolVersion
    # ViewerCertificate_CertificateSource = $config.ViewerCertificate.CertificateSource
}

# Add optional parameters if they exist
if ($config.Aliases.Items) {
    $updateParams.Aliases_Item = $config.Aliases.Items
}

if ($config.CacheBehaviors.Items) {
    $updateParams.CacheBehaviors_Item = $config.CacheBehaviors.Items
}

if ($config.CustomErrorResponses.Items) {
    $updateParams.CustomErrorResponses_Item = $config.CustomErrorResponses.Items
}

# Add Headers if they exist
if ($config.DefaultCacheBehavior.ForwardedValues.Headers.Items) {
    $updateParams.Headers_Item = $config.DefaultCacheBehavior.ForwardedValues.Headers.Items
}

# Add Trusted Signers items if they exist
if ($config.DefaultCacheBehavior.TrustedSigners.Items) {
    $updateParams.TrustedSigners_Item = $config.DefaultCacheBehavior.TrustedSigners.Items
}

# Add Trusted Key Groups items if they exist
if ($config.DefaultCacheBehavior.TrustedKeyGroups.Items) {
    $updateParams.TrustedKeyGroups_Item = $config.DefaultCacheBehavior.TrustedKeyGroups.Items
}

# Handle ViewerCertificate variations
if ($config.ViewerCertificate.ACMCertificateArn) {
    $updateParams.ViewerCertificate_ACMCertificateArn = $config.ViewerCertificate.ACMCertificateArn
}
if ($config.ViewerCertificate.IAMCertificateId) {
    $updateParams.ViewerCertificate_IAMCertificateId = $config.ViewerCertificate.IAMCertificateId
}
if ($config.ViewerCertificate.SSLSupportMethod) {
    $updateParams.ViewerCertificate_SSLSupportMethod = $config.ViewerCertificate.SSLSupportMethod
}

Write-Host "ETag: $etag"
Write-Host "IfMatch: $($updateParams.IfMatch)"

# Update the distribution
Write-Host "Updating CloudFront distribution..."
$result = Update-CFDistribution @updateParams -Select *

Write-Host "Distribution updated successfully!"
Write-Host "Status: $($result.Distribution.Status)"
Write-Host "Origin Path: $((Get-CFDistributionConfig -Id $DistributionID).Origins.Items[0].OriginPath)"

It tried to set it to /d12, but the current origin path was /d5 and the origin path at the end of the script was /d5.

afroz429 · 2026-07-17T22:33:11Z

afroz429
Jul 17, 2026
Collaborator

I tried reproducing by running your same exact code but my setup is different and still may not work for you. The cause seems to be the origin update block.

Origins.Items is a List<Origin>, not an array, so -is [System.Array] is $false and $originToUpdate becomes the whole list. The list has no OriginPath, so your code hits the Add-Member branch and attaches a note property to the list wrapper, never the real Origin. The origin's OriginPath stays unchanged, so CloudFront gets a valid, unchanged request and returns 200 with no error. I confirmed the real Origin.OriginPath never changes.

Fix: index the origin directly

Before:

if ($config.Origins.Items -is [System.Array]) {
    $originToUpdate = $config.Origins.Items[0]
} else {
    $originToUpdate = $config.Origins.Items
}
if ($originToUpdate.PSObject.Properties.Name -contains "OriginPath") {
    $originToUpdate.OriginPath = $normalizedOriginPath
} else {
    $originToUpdate | Add-Member -MemberType NoteProperty -Name "OriginPath" -Value $normalizedOriginPath -Force
}

After:

$originToUpdate = $config.Origins.Items[0]
$originToUpdate.OriginPath = $normalizedOriginPath

Your existing Quantity -ne 1 check already guarantees one origin, so Items[0] is safe here. This one change fixes the no-op. I verified it moves from /d1 to /d12 in my test.

I also recommend adding $ErrorActionPreference = 'Stop' at the top and as the update seems to be non-terminating, re-read the values and throw.

$after = (Get-CFDistributionConfig -Id $DistributionID).Origins.Items[0].OriginPath
if ($after -ne $normalizedOriginPath) { throw "OriginPath did not change: got '$after'" }

Let me know how it goes, may not be able to reply until Monday morning. Thanks

2 replies

wdhowell84 Jul 20, 2026
Author

The answer was both of the things you posted. Thank you so much for the help! I'm a little embarrassed over the array issue. I should've seen that. I guess I was staring at it too long. I've never had any PowerShell or AWS training, so I'm just stumbling through a lot of this stuff as I go. So, I really appreciate your beyond-the-call effort to help. Thank you again!

afroz429 Jul 20, 2026
Collaborator

Happy to help. Please feel free to create discussions or issues if needed

Navigation Menu

Repository navigation

Update-CFDistribution Not Updating Distribution Despite No Loud Failure #425

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Update-CFDistribution Not Updating Distribution Despite No Loud Failure #425

Uh oh!

Uh oh!

wdhowell84 Jul 17, 2026

1. Understand what -Select returns by default

Replies: 3 comments · 4 replies

Uh oh!

afroz429 Jul 17, 2026 Collaborator

Uh oh!

afroz429 Jul 17, 2026 Collaborator

1. Understand what -Select returns by default

2. $AWSHistory was removed in v5, so your ETag is $null

Then verify the change landed

TL;DR

Uh oh!

wdhowell84 Jul 17, 2026 Author

Uh oh!

wdhowell84 Jul 17, 2026 Author

Uh oh!

afroz429 Jul 17, 2026 Collaborator

Fix: index the origin directly

Uh oh!

wdhowell84 Jul 20, 2026 Author

Uh oh!

afroz429 Jul 20, 2026 Collaborator

wdhowell84
Jul 17, 2026

1. Understand what `-Select` returns by default

Replies: 3 comments 4 replies

afroz429
Jul 17, 2026
Collaborator

afroz429
Jul 17, 2026
Collaborator

1. Understand what `-Select` returns by default

2. `$AWSHistory` was removed in v5, so your ETag is `$null`

wdhowell84 Jul 17, 2026
Author

wdhowell84 Jul 17, 2026
Author

afroz429
Jul 17, 2026
Collaborator

wdhowell84 Jul 20, 2026
Author

afroz429 Jul 20, 2026
Collaborator