feat/cloudfront-cross-account-vpc-origin #45021
Open
+114
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Welcome @kharouny 👋 It looks like this is your first Pull Request submission to the Terraform AWS Provider repository. Thank you very much for taking the time to do so, and welcome to the community! 🎉 Community GuidelinesThis comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀 Voting for Prioritization
Pull Request Authors
|
github-actions
bot
added
needs-triage
kharouny
changed the title
kharouny
changed the title
kharouny
changed the title
ewbankkit
added
enhancement
kharouny
force-pushed
the
f-cloudfront-cross-account-vpc-origin
branch
from
3e90409 to
ffe5013
Compare
Fixes hashicorp#45011 AWS released cross-account VPC Origins for CloudFront on November 7, 2025. The CloudFront API requires the OwnerAccountId field when referencing a VPC origin from a different account. Without this parameter, Terraform returns 404 EntityNotFound even when the VPC origin is properly shared via RAM. Changes: - Add owner_account_id field to vpc_origin_config schema (Optional, Computed) - Update expandVPCOriginConfig to include OwnerAccountId when provided - Update flattenVPCOriginConfig to read OwnerAccountId from API response - Add acceptance test TestAccCloudFrontDistribution_vpcOriginConfigOwnerAccountID - Update documentation Backward compatible: When owner_account_id is omitted, CloudFront uses the distribution's account.
kharouny
force-pushed
the
f-cloudfront-cross-account-vpc-origin
branch
from
ffe5013 to
fa5938a
Compare
Author
|
Looks like this needs another pipeline trigger from one of the owners to get the checks running. |
Tobias-RomanoWBD
approved these changes
Nov 12, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Rollback Plan
If a change needs to be reverted, we will publish an updated version of the library.
Changes to Security Controls
No changes to security controls. This adds an optional parameter that enables cross-account resource access already configured via AWS Resource Access Manager (RAM). The parameter only exposes existing AWS CloudFront API functionality.
Description
Adds support for cross-account VPC origins in CloudFront distributions by implementing the
owner_account_idparameter invpc_origin_config.AWS CloudFront requires the
OwnerAccountIdfield when referencing a VPC origin from a different account. Without this parameter, Terraform fails with a 404 EntityNotFound error even when the VPC origin is properly shared via AWS RAM.Changes:
owner_account_idfield tovpc_origin_configschema (Optional, Computed)TestAccCloudFrontDistribution_vpcOriginConfigOwnerAccountIDBackward compatible: When omitted, CloudFront assumes same-account origin (existing behavior).
Relations
Closes #45011
References
Output from Acceptance Testing (Did not run)