Terraform配置CloudFront分发时OAC报错问题排查

我正在完成Cloud Resume Challenge，使用Terraform自动化大部分AWS配置时，在CloudFront分发的OAC（Origin Access Control）配置环节遇到问题，相关参考资料较少。

原Terraform脚本 #

locals {
    s3_origin_id = aws_s3_bucket.gjd_crc_prod_bucket.bucket_regional_domain_name
}

resource "aws_cloudfront_origin_access_control" "crc_cf_oac" {
    name = local.s3_origin_id
    origin_access_control_origin_type = "s3"
    signing_behavior = "always"
    signing_protocol = "sigv4"
}

resource "aws_cloudfront_distribution" "crc_prod_cfdist" {
    origin {
        s3_origin_config {
            origin_access_identity = aws_cloudfront_origin_access_control.crc_cf_oac.id
        }
      domain_name = local.s3_origin_id
      origin_id = local.s3_origin_id
    }
    
    enabled = true
    is_ipv6_enabled = true
    default_root_object = "index.html"

    default_cache_behavior {
        cache_policy_id = "658327ea-f89d-4fab-a63d-7e88639e58f6"
        allowed_methods  = ["GET", "HEAD"]
        cached_methods   = ["GET", "HEAD"]
        target_origin_id = local.s3_origin_id
        viewer_protocol_policy = "https-only"
        compress = true
    }

    viewer_certificate {
      cloudfront_default_certificate = true
    }

    restrictions {
        geo_restriction {
          restriction_type = "none"
          locations = []
        }
    }
}

执行报错信息 #

aws_cloudfront_distribution.crc_prod_cfdist: Modifying... [id=E2F87SH1SP8PTO]
╷
│ Error: updating CloudFront Distribution (E2F87SH1SP8PTO): InvalidOriginAccessIdentity: The specified origin access identity does not exist or is not valid.
│       status code: 400, request id: 927f5e89-4ee0-4fa0-99c6-776547f41e03
│
│   with aws_cloudfront_distribution.crc_prod_cfdist,
│   on cloudfront.tf line 12, in resource "aws_cloudfront_distribution" "crc_prod_cfdist":
│   12: resource "aws_cloudfront_distribution" "crc_prod_cfdist" {
│
╵

问题原因与解决方案 #

错误根源在于混淆了OAC和旧版OAI的配置方式：s3_origin_config块下的origin_access_identity字段是专门给已废弃的Origin Access Identity（OAI）使用的，而OAC需要直接在origin块下通过origin_access_control_id字段来引用，不需要嵌套在s3_origin_config里。

修正后的CloudFront分发origin配置部分：

resource "aws_cloudfront_distribution" "crc_prod_cfdist" {
    origin {
        origin_access_control_id = aws_cloudfront_origin_access_control.crc_cf_oac.id
        domain_name = local.s3_origin_id
        origin_id = local.s3_origin_id
    }
    // 其余配置保持不变
}

内容的提问来源于stack exchange，提问作者Greg Davis