Introduction
Problem
Sometimes users are unable to configure a Amazon CloudFront VPC origin with an Application Load Balancer (ALB) using Terraform.
Terraform apply operations fails with the following error:
InvalidArgument: The parameter Origin DomainName does not refer to a valid S3 bucket
Additionally, the affected CloudFront distributions incorrectly shows the origin type as S3 instead of VPC, indicating a misconfigured origin block.
This prevents successful deployment of CloudFront distributions using an ALB attached via VPC origin.
Cause
The issue could be caused by incorrect Terraform configuration of the CloudFront origin block.
Key Misconfigurations Identified:
Incorrect placement of
vpc_origin_idThe
vpc_origin_idattribute is defined at the wrong level.It must be nested under the required
vpc_origin_configblock.
Unsupported arguments used
subnet_idsandsecurity_group_idswere passed to theaws_cloudfront_vpc_originresource.These attributes were not supported in the deployed provider version.
Schema requirement for
domain_nameCloudFront requires a
domain_nameattribute in the origin block schema.If omitted or misconfigured, CloudFront defaults to validating against S3, resulting in the “Invalid S3 bucket” error.
Version Validation
AWS Provider version used:
v6.12.0(Supported)CloudFront module upgraded to:
v5.0.0(Supported)Verified provider compatibility requirement:
≥ v5.82Verified module compatibility requirement:
≥ v4.0.0
The root cause is purely configuration-related, not a provider or AWS service issue.
Solutions:
The following corrective actions should resolve the issue:
1️⃣ Corrected Origin Block Syntax
Ensure that vpc_origin_id is properly nested:
origin {
domain_name = "placeholder.example.com" # Required by schema
origin_id = "my-vpc-origin"
vpc_origin_config {
vpc_origin_id = aws_cloudfront_vpc_origin.example.id
}
}
2️⃣ Removed Unsupported Attributes
Remove the following unsupported arguments from the aws_cloudfront_vpc_origin resource:
# Removed:
subnet_ids
security_group_ids
3️⃣ Added Placeholder domain_name
A placeholder value should be added for domain_name:
Required by CloudFront schema
Ignored at runtime when using VPC origins
Prevents S3 validation error
4️⃣ Verified Provider & Module Versions
Confirme :
AWS Provider ≥
v5.82CloudFront Module ≥
v4.0.0
Outcome
After applying the corrected configuration:
Terraform
applycompleted successfully.CloudFront distribution correctly recognized the origin as a VPC origin.
ALB was successfully attached as the distribution origin.
No further
InvalidArgumentor S3 validation errors occurred.
The issue was fully resolved through configuration correction without requiring infrastructure changes or AWS-side intervention.