aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Updating AWS::CloudFront::PublicKey results in BadRequest error
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::CloudFront::PublicKey
### Resource Name
_No response_
### Issue Description
Updating the key value of a AWS::CloudFront::PublicKey resource results in a BadRequest error instead of recreating the physical resource. This is because they key value of a CloudFront public key is immutable and CloudFormation doesn't handle the edge case.
### Expected Behavior
CloudFormation should detect that the encoded material of the AWS::CloudFront::PublicKey resource changed and recreate the PublicKey physical resource.
### Observed Behavior
```
Failed resources:
05:01:21 | UPDATE_FAILED | AWS::CloudFront::PublicKey | gatewayLambda/AssetsCFPublicKey (gatewayLambdaAssetsCFPublicKeyXXXXXXXX) Resource handler returned message: "Invalid request provided: AWS::CloudFront::PublicKey" (RequestToken: xxxxxxxx-xxxxx-xxxxx, HandlerErrorCode: InvalidRequest)
new PublicKey (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\@aws-cdk\aws-cloudfront\lib\public-key.ts:42:22)
\_ new GatewayConstruct (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\lib\constructs\gateway.construct.ts:244:22)
\_ new BackendStack (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\lib\stack.ts:47:21)
\_ Object. (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\bin\iac.ts:5:1)
\_ Module._compile (internal/modules/cjs/loader.js:1063:30)
\_ Module.m._compile (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\index.ts:1056:23)
\_ Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
\_ Object.require.extensions. [as .ts] (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\index.ts:1059:12)
\_ Function.Module._load (internal/modules/cjs/loader.js:769:14)
\_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12)
\_ main (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\bin.ts:198:14)
\_ Object. (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\bin.ts:288:3)
\_ Module._compile (internal/modules/cjs/loader.js:1063:30)
\_ Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
\_ Module.load (internal/modules/cjs/loader.js:928:32)
\_ Function.Module._load (internal/modules/cjs/loader.js:769:14)
\_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12)
```
From CloudTrail logs
```json
{
"errorCode": "CannotChangeImmutablePublicKeyFields",
"errorMessage": "You cannot modify encoded material and name of a public key once created.",
}
```
### Test Cases
1. Create a template with a AWS::CloudFront::PublicKey resource.
2. Deploy successfully.
3. Update the `PublicKeyConfig.EncodedKey` value.
4. Attempt a deployment and the error will occur.
### Other Details
Using CDK 1.124.0
Contributor guide
Research direction
Start with the AWS::CloudFront::PublicKey resource and the reported update sequence: create a template, deploy it, change PublicKeyConfig.EncodedKey, and deploy again. Compare the observed CannotChangeImmutablePublicKeyFields error with the expected behavior that the physical resource is recreated when encoded material changes; completion requires a deployment that handles this update without BadRequest.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100