terraform keeps needing to apply some settings

[lrhazi]

I have this test config, which seems to work fine:

module "origin" {
  source = "git::https://github.com/cloudposse/terraform-aws-s3-website.git?ref=tags/0.5.1"
  namespace = "ts-web"
  stage = "prod"
  name = "test"

  hostname = "origin.test.catholic.edu"
  parent_zone_name = "catholic.edu"
  cors_allowed_headers = ["*"]
  cors_allowed_methods = ["GET"]
  cors_allowed_origins = ["*"]
  cors_max_age_seconds = "3600"
  cors_expose_headers = ["ETag"]
  force_destroy = "true"
}

resource "aws_s3_bucket_object" "index" {
 bucket       = "${module.origin.hostname}"
 key          = "index.html"
 source       = "${path.module}/index.html"
 content_type = "text/html"
 etag         = "${md5(file("${path.module}/index.html"))}"
 depends_on = ["module.origin"]
}

# CloudFront CDN fronting origin
module "cdn" {
  source = "git::https://github.com/cloudposse/terraform-aws-cloudfront-cdn.git?ref=tags/0.4.0"
  namespace = "ts-web"
  stage = "prod"
  name = "test"

  aliases = ["test.catholic.edu"]
  origin_domain_name = "origin.test.catholic.edu"
  origin_protocol_policy = "http-only"
  parent_zone_name = "catholic.edu"
  acm_certificate_arn = "arn:aws:acm:us-east-1:947556264854:certificate/e9b7a021-ef1a-49f7-8f2c-5a8e13c89dd2"
  forward_cookies = "none"
  forward_headers = ["Origin", "Access-Control-Request-Headers", "Access-Control-Request-Method"]
  default_ttl = 60
  min_ttl = 0
  max_ttl = 86400
  compress = "true"
  cached_methods = ["GET", "HEAD"]
  allowed_methods = ["GET", "HEAD", "OPTIONS"]
  price_class = "PriceClass_All"

But after applying, any new apply attempt shows these changes needed:

~ module.cdn.aws_cloudfront_distribution.default
      default_cache_behavior.0.forwarded_values.0.headers.0: "Access-Control-Request-Headers" => "Origin"
      default_cache_behavior.0.forwarded_values.0.headers.1: "Access-Control-Request-Method" => "Access-Control-Request-Headers"
      default_cache_behavior.0.forwarded_values.0.headers.2: "Origin" => "Access-Control-Request-Method"
      viewer_certificate.0.cloudfront_default_certificate:   "false" => "true"