aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Updating AWS::CloudFront::PublicKey results in BadRequest error

Open
#924 7 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::CloudFront::PublicKey

### Resource Name

_No response_

### Issue Description

Updating the key value of a AWS::CloudFront::PublicKey resource results in a BadRequest error instead of recreating the physical resource. This is because they key value of a CloudFront public key is immutable and CloudFormation doesn't handle the edge case.

### Expected Behavior

CloudFormation should detect that the encoded material of the AWS::CloudFront::PublicKey resource changed and recreate the PublicKey physical resource.

### Observed Behavior

```
Failed resources:
05:01:21 | UPDATE_FAILED | AWS::CloudFront::PublicKey | gatewayLambda/AssetsCFPublicKey (gatewayLambdaAssetsCFPublicKeyXXXXXXXX) Resource handler returned message: "Invalid request provided: AWS::CloudFront::PublicKey" (RequestToken: xxxxxxxx-xxxxx-xxxxx, HandlerErrorCode: InvalidRequest)
new PublicKey (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\@aws-cdk\aws-cloudfront\lib\public-key.ts:42:22)
\_ new GatewayConstruct (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\lib\constructs\gateway.construct.ts:244:22)
\_ new BackendStack (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\lib\stack.ts:47:21)
\_ Object. (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\bin\iac.ts:5:1)
\_ Module._compile (internal/modules/cjs/loader.js:1063:30)
\_ Module.m._compile (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\index.ts:1056:23)
\_ Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
\_ Object.require.extensions. [as .ts] (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\index.ts:1059:12)
\_ Function.Module._load (internal/modules/cjs/loader.js:769:14)
\_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12)
\_ main (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\bin.ts:198:14)
\_ Object. (C:\Users\Romain\Documents\1.REPOS\cloud-platform\backend\node_modules\ts-node\src\bin.ts:288:3)
\_ Module._compile (internal/modules/cjs/loader.js:1063:30)
\_ Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
\_ Module.load (internal/modules/cjs/loader.js:928:32)
\_ Function.Module._load (internal/modules/cjs/loader.js:769:14)
\_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12)
```

From CloudTrail logs
```json
{
"errorCode": "CannotChangeImmutablePublicKeyFields",
"errorMessage": "You cannot modify encoded material and name of a public key once created.",
}
```

### Test Cases

1. Create a template with a AWS::CloudFront::PublicKey resource.
2. Deploy successfully.
3. Update the `PublicKeyConfig.EncodedKey` value.
4. Attempt a deployment and the error will occur.

### Other Details

Using CDK 1.124.0

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::CloudFront::PublicKey resource and the reported update sequence: create a template, deploy it, change PublicKeyConfig.EncodedKey, and deploy again. Compare the observed CannotChangeImmutablePublicKeyFields error with the expected behavior that the physical resource is recreated when encoded material changes; completion requires a deployment that handles this update without BadRequest.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.