Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Since these actions may be merged in bulk, extra checklist to help:

• Rebase on Actions plumbing #43669 after it's updated, deconflicted
• Changelog
• PR description
• Action file
• Test file with terraform_data trigger
• Test results in PR
• website/docs/actions/ file
• Warning at top of website docs
• Update warning on top of website docs
• Service package registration
• Update code for simplified actions
• Use region pattern (framework.WithRegionModel) (N/A, global resource)
• Add 1.14 skips for tests
• Add authorization skip
• Rerun all tests after final rebase

This PR introduces a new Terraform action that allows users to invalidate a CloudFront distribution cache for specified paths. The action creates an invalidation request via the AWS CloudFront API and waits for it to complete, providing real-time progress updates throughout the process. Users can specify individual files, directory wildcards, or invalidate all cached content, with configurable timeouts and optional caller references for tracking.

The action is designed for common CI/CD workflows where cache invalidation is needed after deploying updated static assets. It integrates seamlessly with terraform_data lifecycle triggers, enabling automatic cache invalidation during infrastructure updates. The implementation includes comprehensive validation, error handling for CloudFront-specific scenarios (like too many concurrent invalidations), and follows the established AWS provider patterns for actions with proper documentation and acceptance tests.

resource "aws_cloudfront_distribution" "example" {
  # ... distribution configuration
}

action "aws_cloudfront_create_invalidation" "example" {
  config {
    distribution_id = aws_cloudfront_distribution.example.id
    paths           = ["/*"]
  }
}

resource "terraform_data" "example" {
  input = "trigger-invalidation"

  lifecycle {
    action_trigger {
      events  = [before_create, before_update]
      actions = [action.aws_cloudfront_create_invalidation.example]
    }
  }
}

Relations

• Depends on Actions plumbing #43669
• New action: aws_lambda_invoke #43972
• New action: aws_cloudfront_create_invalidation #43955 (this)
• New action: aws_ses_send_email #44214
• New action: aws_sns_publish #44232
• New action: aws_ec2_stop_instance #43700

References

Output from Acceptance Testing

% make t T=TestAccCloudFrontCreateInvalidationAction_basic K=cloudfront
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.24.6 test ./internal/service/cloudfront/... -v -count 1 -parallel 20 -run='TestAccCloudFrontCreateInvalidationAction_basic'  -timeout 360m -vet=off
2025/08/19 16:25:11 Creating Terraform AWS Provider (SDKv2-style)...
2025/08/19 16:25:11 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCloudFrontCreateInvalidationAction_basic
=== PAUSE TestAccCloudFrontCreateInvalidationAction_basic
=== CONT  TestAccCloudFrontCreateInvalidationAction_basic
--- PASS: TestAccCloudFrontCreateInvalidationAction_basic (541.27s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront	549.580s