Terraform-provider-aws: aws_cloudfront_distribution - "Only one viewer certificate change may be in progress at a time"

[hashibot]

_This issue was originally opened by @ozbillwang as hashicorp/terraform#13495. It was migrated here as part of the provider split. The original body of the issue is below._

---

Hi there,

Terraform Version

v0.9.1

Affected Resource(s)

• aws_cloudfront_distribution

Terraform Configuration Files

Apply below resource first, it is successful.

resource "aws_cloudfront_distribution" "cdn" {
    ....
    viewer_certificate {
        cloudfront_default_certificate = true
    }

Then update to use Custom SSL Certificate (example.com)

data "aws_iam_server_certificate" "domain" {
  name = "example.com_wildcard"
  latest      = true
}

resource "aws_cloudfront_distribution" "cdn" {
    ....

    viewer_certificate {
        iam_certificate_id = "${aws_iam_server_certificate.domain.id}"
        minimum_protocol_version = "TLSv1"
        ssl_support_method = "sni-only"
    }
}

Debug Output

Panic Output

Expected Behavior

What should have happened?

Resource aws_cloudfront_distribution.cdn should be updated with new custom SSL certificate.

Actual Behavior

Error applying plan:

1 error(s) occurred:

* module.web.aws_cloudfront_distribution.cdn: 1 error(s) occurred:

* aws_cloudfront_distribution.cdn: IllegalUpdate: Only one viewer certificate change may be in progress at a time.
    status code: 400, request id: 1ba221a9-1dac-11e7-bd65-89380dff957f

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply to apply the resource aws_cloudfront_distribution.cdn
2. update tf file with custom ssl certificate in part of viewer_certificate
3. get error whenterraform apply
4. manually delete the resource aws_cloudfront_distribution.cdn
5. successfully run terraform apply

Important Factoids

References

Confirmed I provided certificate id, not arn in tf configuraiton.

https://github.com/hashicorp/terraform/issues/9553

[EugeneKay]

I have run into this issue as well during a certificate change. The referenced Cloudfront_Distribution object has status "InProgress", and during this period modifications are not allowed. Waiting 15-20 minutes and re-running terraform apply results in success.

[bflad]

Hi folks 👋 In version 2.1.0 of the Terraform AWS Provider, the aws_cloudfront_distribution resource will now wait for changes to be fully deployed on creation and update, so this error should effectively not occur unless the process is manually cancelled. The new version with this change should release middle of this week. 👍

If you have any lingering issues with this or anything related on the newer version, please open a new GitHub issue for further triage. Thanks!

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!