CloudFront multi tenant distribution updates failing recently due to invalid originPath parameters

The issue you're experiencing with your CloudFront multi-tenant distribution is likely related to the format of your origin path parameters. In CloudFront multi-tenant distributions, origin path parameters need to follow a specific format.

Valid origin path parameter formats include:

• /{{parameter2}}
• /{{parameter2}}/test
• /public/{{parameter2}}/test
• /search?name={{parameter2}}

The parameters in your origin path should be enclosed in double curly braces like {{parameter}}. If you're using a different format, this could be causing the validation error when you try to update your distribution.

For your specific case where you're using an S3 origin with a parameterized bucket and path, ensure that your origin path follows the correct parameter syntax with double curly braces. For example, instead of using (bucket).s3.ap-south-1.amazonaws.com/(subdir), you should use something like {{bucket}}.s3.ap-south-1.amazonaws.com/{{subdir}} or ensure the path portion follows the format /{{subdir}}.

Also, when using CloudFront with S3, be aware that there are specific considerations:

1. If you're using S3 website endpoints, you cannot use Origin Access Control (OAC)
2. If you're using regular S3 bucket origins, you can use OAC but need appropriate bucket policies

Update your origin path parameter format to match the required syntax, and you should be able to update your distribution configuration again.
Sources
Distribution tenant customizations - Amazon CloudFront
Cloudfront cannot access s3 bucket | AWS re:Post
Static Web Pages Outside of the Optional Path in my S3 CloudFront Origin Denied Access | AWS re:Post

"In fact, my origin format is like this: {{bucket}}.s3.ap-south-1.amazonaws.com/{{subdir}}."