aws_cloudfront_distribution default_cache_behavior

[kleinerator]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7

• provider.archive v1.0.3
• provider.aws v1.20.0
• provider.local v1.1.0
• provider.template v1.0.0

Affected Resource(s)

aws_cloudfront_distribution default_cache_behavior

Terraform Configuration Files

  default_cache_behavior {
    allowed_methods = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
    cached_methods  = ["GET", "HEAD", "OPTIONS"]

    target_origin_id = "origin-${var.lifecycle}.${var.domainname}"
    compress         = true

    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    default_ttl            = 0
    max_ttl                = 86400

    forwarded_values {
      query_string = true

      headers = "${var.headers_whitelist}"

      cookies {
        forward = "none"
      }
    }

    lambda_function_association {
      event_type = "origin-request"
      lambda_arn = "${aws_lambda_function.https-redirect-hosts.qualified_arn}"
    }
  }p

Debug Output

https://gist.github.com/kleinerator/b6b70bfc2a358258a6127dbf5cd635df

Panic Output

Expected Behavior

It should act like ordered_cache_behavior updates on calculated lambda's will fully qualified arn values.
ordered_cache_behavior.1.lambda_function_association.1549868313.event_type: "origin-request" => ""
ordered_cache_behavior.1.lambda_function_association.1549868313.lambda_arn: "arn:aws:lambda:us-east-1:356379865219:function:station-sites_https_redirect_edge_lambda_qa:2" => ""
ordered_cache_behavior.1.lambda_function_association.~1202208379.event_type: "" => "origin-request"
ordered_cache_behavior.1.lambda_function_association.~1202208379.lambda_arn: "" => "${aws_lambda_function.https-redirect-hosts.qualified_arn}"

Actual Behavior

it tries to replace the entire default cache behavior and fails and then my apply fails even though I'm not trying to change anything.

Steps to Reproduce

Write some terraform that builds an edge lambda and use the qualified arn to add to your default behavior.

1. terraform apply

Important Factoids

References

• #0000

[bflad]

Hi @kleinerator 👋 Two questions here:

• I notice this change occurring in your plan output as well: "CloudFront-Viewer-Country" => "" with the forwarded headers -- is this expected?
• Aside from that, is the aws_cloudfront_distribution update the only item in your terraform plan output? It seems odd that its outputting "${aws_lambda_function.https-redirect-hosts.qualified_arn}" instead of its actual value or <computed>. Anything special about how terraform plan was invoked, like resource targeting?

The terraform plan output can definitely be a pain to read, especially with aws_cloudfront_distribution resource with all its nested TypeSet attributes. 😖 This might be a good candidate for upvoting the upstream hashicorp/terraform issue on improving it.

[kleinerator]

I've been trying to get this to run in my nonprod environment. I have made manual changes to experiment and adding CloudFront-Viewer-Country was one of those changes.
Here are the commands that are run
terraform fmt -list -check
terraform validate -var-file qa.tfvars -input=false
terraform plan -var-file qa.tfvars -input=false -out=tfplan
terraform apply -input=false tfplan

[bflad]

Hi @kleinerator 👋 are you still having trouble? We've made some improvements to the aws_cloudfront_distribution handling in version 2.0.0 of the Terraform AWS Provider and have a few more going in with version 2.1.0 releasing later this week.

[bflad]

Closing due to lack of response, but please do reach out if there is still trouble after version 2.1.0.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!