CloudFront Distribution receives IllegalUpdate error when applying change to Origin

[knottnt]

Describe the bug
After applying a change to an origin of a CloudFront Distribution that has been successfully created the ACK controller fails to apply the update to the AWS resource reporting that an IllegalUpdate occurred.

Steps to reproduce
Create a CloudFront Distribution such as the one below.

apiVersion: cloudfront.services.k8s.aws/v1alpha1
kind: Distribution
metadata:
  name: my-distribution
spec:
  distributionConfig:
    comment: "test distribution"
    enabled: true
    defaultCacheBehavior:
      targetOriginID: <s3-buck-name>
      viewerProtocolPolicy: allow-all
      minTTL: 1000
      forwardedValues:
        queryString: false
        cookies:
          forward: "none"
    origins:
      items:
      - id: <s3-buck-name> 
        connectionTimeout: 9
        domainName: <s3-buck-domain-name>
        s3OriginConfig:
          originAccessIdentity: ''
  tags:
  - key: hello
    value: world

Once the Distribution has been deployed and the ACK controller reports that it has synced. Apply an update to the Distribution.

apiVersion: cloudfront.services.k8s.aws/v1alpha1
kind: Distribution
metadata:
  name: my-distribution
spec:
  distributionConfig:
    comment: "test distribution"
    enabled: true
    defaultCacheBehavior:
      targetOriginID: <s3-buck-name>
      viewerProtocolPolicy: allow-all
      minTTL: 1000
      forwardedValues:
        queryString: false
        cookies:
          forward: "none"
    origins:
      items:
      - id: <s3-buck-name> 
        connectionTimeout: 8 # Updated value
        domainName: <s3-buck-domain-name>
        s3OriginConfig:
          originAccessIdentity: ''
  tags:
  - key: hello
    value: world

The ACK controller fails to apply the update reporting the below error.

{
  "level": "error",
  "ts": "2025-05-08T10:17:48.237-0700",
  "msg": "Reconciler error",
  "controller": "distribution",
  "controllerGroup": "cloudfront.services.k8s.aws",
  "controllerKind": "Distribution",
  "Distribution": {
    "name": "my-distribution",
    "namespace": "default"
  },
  "namespace": "default",
  "name": "my-distribution",
  "reconcileID": "4aac5bf1-6bb3-4688-a0b4-cd9ec22e8127",
  "error": "operation error CloudFront: UpdateDistribution, https response error StatusCode: 400, RequestID: 4f6c5d93-d535-4398-adc2-14bcd2d463ce, IllegalUpdate: The 'OriginCustomHeaders' field is missing.",
  "stacktrace": "sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"
}

Expected outcome
The ACK successfully applies the spec changes to the CloudFront Distribution.

Environment

• Kubernetes version: 1.32.2
• Using EKS (yes/no), if so version? No, KIND local cluster
• AWS service targeted (S3, RDS, etc.) CloudFront

[github-actions]

Hello @knottnt 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[remmercier]

As a workaround it is possible to set an empty array for customHeaders.items field. We also need to set originPath field to make update working and not get and IllegalUpdate error.

apiVersion: cloudfront.services.k8s.aws/v1alpha1
kind: Distribution
metadata:
  name: my-distribution
spec:
  distributionConfig:
    comment: "test distribution"
    enabled: true
    defaultCacheBehavior:
      targetOriginID: <s3-buck-name>
      viewerProtocolPolicy: allow-all
      minTTL: 1000
      forwardedValues:
        queryString: false
        cookies:
          forward: "none"
    origins:
      items:
      - id: <s3-buck-name> 
        connectionTimeout: 8 # Updated value
        domainName: <s3-buck-domain-name>
        s3OriginConfig:
          originAccessIdentity: ''
        customHeaders:
          items: []
        originPath: ''
  tags:
  - key: hello
    value: world