[Enhancement]: Add lambda and mediapackagev2 options for origin_access_control_origin_type to aws_cloudfront_origin_access_control

[micchickenburger]

Description

The aws_cloudfront_origin_access_control resource has argument origin_access_control_origin_type with valid options s3 and mediastore. However, lambda and mediapackagev2 should also be allowed.

 Error: expected origin_access_control_origin_type to be one of ["s3" "mediastore"], got lambda
│ 
│   with module.cloudfront.aws_cloudfront_origin_access_control.oac,
│   on modules/cloudfront/main.tf line 30, in resource "aws_cloudfront_origin_access_control" "oac":
│   30:   origin_access_control_origin_type = "lambda"

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html

Affected Resource(s) and/or Data Source(s)

• aws_cloudfront_origin_access_control

Potential Terraform Configuration

resource "aws_cloudfront_origin_access_control" "oac" {
  name                              = "oac-lambda"
  description                       = "OAC Policy for lambda function"
  origin_access_control_origin_type = "lambda"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

References

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html

• Lambda announcement
• Elemental MediaPackage announcement

Would you like to implement a fix?

No

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[micchickenburger]

Interestingly, other official documentation is also missing the lambda and mediapackagev2 values:

• https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudfront/create-origin-access-control.html
• https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateOriginAccessControl.html

Furthermore, the AWS Console does not seem to allow the creation of an OAC for custom or lambda function domains either.

But the AWS CLI is happy to create one:

$ aws cloudfront create-origin-access-control --origin-access-control-config "Name=oac,SigningProtocol=sigv4,SigningBehavior=always,OriginAccessControlOriginType=lambda"

{
    "Location": "https://cloudfront.amazonaws.com/2020-05-31/origin-access-control/XXXXXXXXXXXXX",
    "ETag": "XXXXXXXXXXXXX",
    "OriginAccessControl": {
        "Id": "XXXXXXXXXXXXX",
        "OriginAccessControlConfig": {
            "Name": "oac",
            "SigningProtocol": "sigv4",
            "SigningBehavior": "always",
            "OriginAccessControlOriginType": "lambda"
        }
    }
}

This change is reflected in the AWS Console too:

Manually updating the CloudFront Distribution to associate the OAC with the origin also works successfully, per the documentation here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

[jtyrus]

Did a quick check and looks like v1 cloudfront doesn't have those listed... but the AWS module isn't doing any validation on the string during creation. Ran a test without terraform validation and was able to get it to work. I can make this update.

// Cloudfront V1 api.go
type OriginAccessControlConfig struct {
   OriginAccessControlOriginType *string `type:"string" required:"true" enum:"OriginAccessControlOriginTypes"`
...
}

...
const (
	// OriginAccessControlOriginTypesS3 is a OriginAccessControlOriginTypes enum value
	OriginAccessControlOriginTypesS3 = "s3"

	// OriginAccessControlOriginTypesMediastore is a OriginAccessControlOriginTypes enum value
	OriginAccessControlOriginTypesMediastore = "mediastore"
)

// OriginAccessControlOriginTypes_Values returns all elements of the OriginAccessControlOriginTypes enum
func OriginAccessControlOriginTypes_Values() []string {
	return []string{
		OriginAccessControlOriginTypesS3,
		OriginAccessControlOriginTypesMediastore,
	}
}

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.46.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.