Cloudfront: Unable to update a tag on a VpcOrigin
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Hello,
We have a lot of nested stacks and one of the nested tags is for creating cloudfront distribution with private ELB as one of the origins. As per our company policy, we have attached some tags to the resources and due to a recent policy change, we were attempting to change the value for one of the tags and was getting the below error.
`Resource handler returned message: "Invalid request provided: AWS::CloudFront::VpcOrigin: The specified VPC origin is currently associated with one or more distributions. Please disassociate the VPC origin from all distributions before updating or deleting (Service: CloudFront, Status Code: 409...`
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
Changing tag value should not require us to detach and recreate VPC origin.
### Current Behavior
CDK deploy command fails with the below error
``Resource handler returned message: "Invalid request provided: AWS::CloudFront::VpcOrigin: The specified VPC origin is currently associated with one or more distributions. Please disassociate the VPC origin from all distributions before updating or deleting (Service: CloudFront, Status Code: 409...``
### Reproduction Steps
Create CFD and VPC origin with a tag and then either try to add a new tag or change the tag name.
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.218.0
### AWS CDK CLI version
2.1029.3 (build 2f0cfc4)
### Node.js Version
v22.14.0
### OS
AL 2023
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start by reproducing the CDK deploy with a CloudFront distribution, a VPC origin, and a tag change using aws-cdk-lib 2.218.0. Trace how the VPC origin update is synthesized and applied; done means changing or adding a tag deploys successfully without detaching or recreating the origin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100