[Bug]: Take 2 - Adding a New CloudFront Origin Causes All Other Origins to be Redeployed

[cgagnon-crakmn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Core Version

1.8.2

AWS Provider Version

5.54.1

Affected Resource(s)

aws_cloudfront_distribution

Expected Behavior

Displaying a diff of changed origins
Unchanged behaviors should not be shown as removed/added.

Actual Behavior

The displayed diff shows all origins as removed and added.
It if really difficult to analyse the differences.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

New cloudfront distribution resource

resource "aws_cloudfront_distribution" "test_cdn" {
  enabled         = true
  is_ipv6_enabled = true
  comment         = "Testing CDN"
  price_class     = "PriceClass_All"

  origin {
    domain_name = "perdu.com"
    origin_id   = "proxy"

    custom_origin_config {
      http_port              = "80"
      https_port             = "443"
      origin_protocol_policy = "http-only"
      origin_ssl_protocols   = ["TLSv1"]
    }
  }

  default_cache_behavior {
    target_origin_id       = var.origin_id
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  ordered_cache_behavior {
    path_pattern     = "/content/immutable/*"
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD", "OPTIONS"]
    target_origin_id = var.origin_id

    forwarded_values {
      query_string = false
      headers      = ["Origin"]

      cookies {
        forward = "none"
      }
    }

    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
    compress               = true
    viewer_protocol_policy = "redirect-to-https"
  }

  viewer_certificate {
    acm_certificate_arn      = var.ssl_certificate_arn
    minimum_protocol_version = "TLSv1.1_2016"
    ssl_support_method       = "sni-only"
  }

Modified cloudfront distribution resource

resource "aws_cloudfront_distribution" "test_cdn" {
  enabled         = true
  is_ipv6_enabled = true
  comment         = "Testing CDN"
  price_class     = "PriceClass_All"

  origin {
    domain_name = "perdu.com"
    origin_id   = "perdu"

    custom_origin_config {
      http_port              = "80"
      https_port             = "443"
      origin_protocol_policy = "http-only"
      origin_ssl_protocols = ["TLSv1"]
    }
  }

  origin {
    domain_name = "perdu.com"
    origin_id   = "perdu2"

    custom_origin_config {
      http_port              = "80"
      https_port             = "443"
      origin_protocol_policy = "http-only"
      origin_ssl_protocols = ["TLSv1"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "perdu"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods = ["GET", "HEAD"]
    compress               = true

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  ordered_cache_behavior {
    path_pattern     = "/content/immutable/*"
    allowed_methods = ["GET", "HEAD", "OPTIONS"]
    cached_methods = ["GET", "HEAD", "OPTIONS"]
    target_origin_id = "perdu"

    forwarded_values {
      query_string = false
      headers = ["Origin"]

      cookies {
        forward = "none"
      }
    }

    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
    compress               = true
    viewer_protocol_policy = "redirect-to-https"
  }

  viewer_certificate {
    acm_certificate_arn      = var.ssl_certificate_arn
    minimum_protocol_version = "TLSv1.1_2016"
    ssl_support_method       = "sni-only"
  }

Steps to Reproduce

1. Create a aws_cloudfront_distribution from the new cloudfront distribution resource mentionned above.
2. Run apply
3. Replace the aws_cloudfront_distribution by the modified cloudfront distribution resource mentionned above.
4. Run apply

Debug Output

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudfront_distribution.test_cdn will be updated in-place
  ~ resource "aws_cloudfront_distribution" "test_cdn" {
      ~ comment                         = "Testing CDN" -> "Cedric G. Testing CDN"
        id                              = "E2YUD3GHLBCN1V"
      ~ price_class                     = "PriceClass_All" -> "PriceClass_100"
        tags                            = {}
        # (21 unchanged attributes hidden)

      - origin {
          - connection_attempts      = 3 -> null
          - connection_timeout       = 10 -> null
          - domain_name              = "perdu.com" -> null
          - origin_id                = "perdu" -> null
            # (2 unchanged attributes hidden)

          - custom_origin_config {
              - http_port                = 80 -> null
              - https_port               = 443 -> null
              - origin_keepalive_timeout = 5 -> null
              - origin_protocol_policy   = "http-only" -> null
              - origin_read_timeout      = 30 -> null
              - origin_ssl_protocols     = [
                  - "TLSv1",
                ] -> null
            }
        }
      + origin {
          + connection_attempts      = 3
          + connection_timeout       = 10
          + domain_name              = "perdu.com"
          + origin_id                = "perdu2"
            # (2 unchanged attributes hidden)

          + custom_origin_config {
              + http_port                = 80
              + https_port               = 443
              + origin_keepalive_timeout = 5
              + origin_protocol_policy   = "http-only"
              + origin_read_timeout      = 30
              + origin_ssl_protocols     = [
                  + "TLSv1",
                ]
            }
        }
      + origin {
          + connection_attempts = 3
          + connection_timeout  = 10
          + domain_name         = "perdu.com"
          + origin_id           = "perdu"
            # (1 unchanged attribute hidden)

          + custom_origin_config {
              + http_port                = 80
              + https_port               = 443
              + origin_keepalive_timeout = 5
              + origin_protocol_policy   = "http-only"
              + origin_read_timeout      = 30
              + origin_ssl_protocols     = [
                  + "TLSv1",
                ]
            }
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Panic Output

N/A

Important Factoids

N/A

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[bbeesley]

@cgagnon-crakmn I'm interested in your comment

It if really difficult to analyse the differences.

I'm having the same issue, and while I agree it's difficult to analyse the differences, my main concern is whether or not terraform is going to delete the origins then recreate identical ones. This would be a much more serious issue since it would result in downtime while the change propagates. But the fact that you're mostly concerned about the diff seems to imply thats not the case? Have you tried applying the change and seen what the behaviour is? Does it actually delete the origins and recreate them?

[bbeesley]

Update: just tried it out in a dev account and it seems like there isn't a period where origins are missing. The new origins appear in the console alongside the existing ones right at the same time that the distribution starts modifying. I'm still a bit nervous to try this out in prod though.

[cgagnon-crakmn]

@bbeesley I am more concerns about not knowing the changes that will be applied.

I don't recall seeing issues with origins missing. I have not testing it thoroughly, but the AWS API does update a distribution, which includes the origins, but no call to remove origins. Removing origins does't seem possible if in use.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowToUpdateDistribution.html

[seanmacisaac]

I've also not seen any availability issues, but the inability to reasonably analyze what is actually going to chang is a big risk that I would love to be able to avoid.

[pererasu]

I'm having a similar issue whereby every run of terragrunt, whether or not there are changes to the cloudfront distribution, Terraform says its going to remove all origins and add them back.

Aws provider 5.72.1
Terraform 1.73,
Terragrunt 0.68.1

[batflarrow]

I’m encountering the same issue when attempting to add a new origin to an existing CloudFront distribution. Instead of simply adding the new origin, it removes the existing one and creates an identical copy. I’ve tried adjusting the state and testing various configurations by setting the origin_path to an empty string, null, or completely omitting the key. I’ve also applied similar approaches to the origin_access_control_id attribute. However, it continues to add and remove the existing origin along with the new one.

AWS Provider: 5.72.1
Terraform: 1.1.8

[yowatanabe]

I had the same problem when I tried to add a new origin to my existing CloudFront distribution.

Aws provider 5.78.0
Terraform 1.10.0

[renniet]

I also ran into this issue. Tried changing empty values of fields from "" to null to rule that out. Various origins with a combination of with and without s3_origin_config, origin_shield.
Strange thing is it doesn't do it to all my distributions, only a certain few.

terraform --version
Terraform v1.8.1
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.86.1

[jackroberts-gh]

Had this issue for a while - assumed it was something to do with how we were ordering (or not ordering) our origins when looping through to create dynamic origins.

+1 for a fix.