GitHub Action chetan/invalidate-cloudfront-action@v2 Fails with NoSuchDistribution

Hello.

Can you share an example of the workflow file you're using?
I tried the following GitHub Actions workflow on my AWS account and confirmed that I was able to successfully delete the CloudFront cache.
Are CloudFront and S3 hosted under the same AWS account?

name: Deploy
on:
  pull_request:
    branches:
      - main
    types: [closed]

permissions:
  id-token: write
  actions: write
  contents: read
  pull-requests: read

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@master

      - uses: aws-actions/configure-aws-credentials@v4
        env:
          AWS_ACCOUNT_ID: 123456789012
        with:
          aws-region: "ap-northeast-1"
          role-to-assume: "arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/role-dev-github-oidc-s3-deploy"

      # Upload to S3
      - name: sync s3
        run: aws s3 sync ./html/ s3://your-s3-bucket-name --delete

      # Invalidate CloudFront (this action)
      - name: Invalidate CloudFront
        uses: chetan/invalidate-cloudfront-action@v2
        env:
          DISTRIBUTION: ES12345678901
          PATHS: "/index.html"
          AWS_REGION: "us-east-1"

hi Riku,

Thank you for response.

Yes — both CloudFront and S3 are hosted under the same AWS account. I'm using a GitHub Actions workflow that authenticates using access key + secret stored in repository secrets.

Here's the relevant portion of my current workflow file:

     - name: Invalidate CloudFront cache
      uses: chetan/invalidate-cloudfront-action@v2
      env:
       DISTRIBUTION: EO9YJD19H7YWS   
       PATHS: "/*"
      AWS_REGION: us-west-1
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

The "NoSuchDistribution" error you're encountering indicates that the CloudFront distribution ID you're using in your GitHub Action doesn't exist or cannot be found by the AWS credentials you're providing. Here are some potential causes and solutions:

1. Distribution ID Format: Verify that the CloudFront distribution ID is in the correct format (typically starts with "E" followed by alphanumeric characters) and doesn't contain any typos or extra spaces.

2. AWS Region Mismatch: Ensure that the AWS region configured in your GitHub Action matches the region where your CloudFront distribution is deployed. CloudFront is a global service, but the API endpoints are region-specific.

3. IAM Permissions: While you mentioned having CloudFrontFullAccess, double-check that the specific permission for cloudfront:CreateInvalidation is included and not restricted by any IAM policy conditions.

4. AWS Account Mismatch: Verify that the AWS credentials you're using correspond to the same AWS account where the CloudFront distribution exists. If you're working with multiple AWS accounts, you might be using credentials from one account to access resources in another.

5. Distribution Status: Ensure that your CloudFront distribution is in the "Deployed" state and not "In Progress" or "Disabled".

6. Action Configuration: Check the configuration of the chetan/invalidate-cloudfront-action@v2 action in your workflow file, ensuring all required parameters are correctly specified.

To troubleshoot further, you could try:

• Temporarily using the AWS CLI directly in your workflow to run the invalidation command to see if it provides more detailed error information
• Verifying the distribution ID by listing all distributions with the AWS CLI or console
• Checking CloudTrail logs for more details about the failed API call
  Sources
  CreateInvalidation - Amazon CloudFront

hi again,

Thanks for correcting that, but this didn't solve the error.

What did solve the problem was realizing that the specific credentials I was using were the issue. I used the exact same access keys from my GitHub Action to run the command on my local system, and that's what made it work.

Though GitHub Actions don't look for your local credentials, my discovery was that CloudFront is specific not just to the account, but to the exact credentials you're using to make a request, even if everything is in the same account.

It worked at the end, now I'm dealing with the UI LOL!

Best,