amazon-web-servicesamazon-cloudfrontamazon-iam

CloudFront policy to invalidate only specific distribution

I'm using S3 bucket to store files and CloudFront to distribute them. I have a tool that handles synchronization automatically and it works great.

However, I want to be able to also create CloudFront invalidations programmatically. What statement do I need to add to the tool's policy in order to allow creating invalidation only for this specific distribution?

Right now, I have this statement:

{
    "Effect": "Allow",
    "Action": [
        "cloudfront:CreateInvalidation"
    ],
    "Resource": "*"
}

But, as you can see, it allows to create invalidations for any distribution in account.

I've tried to use these values for Resource property, but for some reason the tool gave me an error, saying that access is denied:

What do I need to specify in Resource property in order to allow creation of invalidation only for the specific distribution?

Its ARN is arn:aws:cloudfront::12345678:distribution/ABCDEFG for example.

Solution

  • Update: As of 2021, the cloudfront:CreateInvalidation action supports resource-level permissions and can be used to allow invalidating only a specific distribution. See @GraphicalDot's answer below. Original answer — as of 2017 — below.

    The cloudfront:CreateInvalidation command does not support resource-level permissions. For this reason, only * is supported. Thus, it is not possible to restrict a user/role to only be able to invalidate a specific distribution.

    Source: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html