Fix cloudfront_distribution s3_origin_access_identity_enabled bug (an…

…sible-collections#881) Fix cloudfront_distribution s3_origin_access_identity_enabled bug SUMMARY If s3_origin_access_identity_enabled is set to True but no s3_origin_config then a default origin config is applied however it also picks up s3_origin_access_identity_enabled as S3OriginAccessIdentityEnabled and passes it to the API request which is not a valid option to be passed and then fails validation. Fixes: ansible-collections#749 ISSUE TYPE Bugfix Pull Request COMPONENT NAME cloudfront_distribution ADDITIONAL INFORMATION The option mention is not valid for the API request: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudfront.html#CloudFront.Client.create_distribution Reviewed-by: Markus Bergholz <[email protected]> Reviewed-by: Alina Buzachis <None>
abikouo · Sep 18, 2023 · 7247b4a · 7247b4a
1 parent f1ce59e
commit 7247b4a
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/cloudfront_distribution.py b/cloudfront_distribution.py
@@ -1686,9 +1686,6 @@ def validate_origins(self, client, config, origins, default_origin_domain_name,
             self.module.fail_json_aws(e, msg="Error validating distribution origins")
 
     def validate_s3_origin_configuration(self, client, existing_config, origin):
-        if not origin['s3_origin_access_identity_enabled']:
-            return None
-
         if origin.get('s3_origin_config', {}).get('origin_access_identity'):
             return origin['s3_origin_config']['origin_access_identity']
 
@@ -1719,13 +1716,20 @@ def validate_origin(self, client, existing_config, origin, default_origin_path):
                 origin['custom_headers'] = ansible_list_to_cloudfront_list()
             if self.__s3_bucket_domain_identifier in origin.get('domain_name').lower():
                 if origin.get("s3_origin_access_identity_enabled") is not None:
-                    s3_origin_config = self.validate_s3_origin_configuration(client, existing_config, origin)
+                    if origin['s3_origin_access_identity_enabled']:
+                        s3_origin_config = self.validate_s3_origin_configuration(client, existing_config, origin)
+                    else:
+                        s3_origin_config = None
+
+                    del(origin["s3_origin_access_identity_enabled"])
+
                     if s3_origin_config:
                         oai = s3_origin_config
                     else:
                         oai = ""
+
                     origin["s3_origin_config"] = dict(origin_access_identity=oai)
-                    del(origin["s3_origin_access_identity_enabled"])
+
                     if 'custom_origin_config' in origin:
                         self.module.fail_json(msg="s3_origin_access_identity_enabled and custom_origin_config are mutually exclusive")
             else: