Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-63690

CloudFront Distribution not deleted by ccoctl aws delete

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.16, 4.17, 4.18, 4.19, 4.20, 4.21
    • Cloud Credential Operator
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Rejected
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-63561. The following is the description of the original issue:
      —
      Description of problem:

      CloudFront Distribution not deleted by ccoctl aws delete.
Compared the logs, seems it didn't get the distribution by tags successfully.
Current log:
[cloud-user@preserved-jshu verify]$ ./ccoctl aws delete --name jshuaws11 --region us-east-1
...
2025/10/26 21:49:05 Identity Provider bucket jshuaws11-oidc deleted
2025/10/26 21:49:25 failed to delete the CloudFront origin access identity with ID E3I4QD2PBVGYZ6: operation error CloudFront: DeleteCloudFrontOriginAccessIdentity, https response error StatusCode: 409, RequestID: c93445d3-673d-4d3d-a37a-641827cea46a, CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.
2025/10/26 21:49:40 Policy jshuaws11-openshift-cloud-credential-operator-cloud-credential-o associated with IAM Role jshuaws11-openshift-cloud-credential-operator-cloud-credential-o deleted
...

Old successful log:
[cloud-user@jshu-gcp cco]$ ./ccoctl aws delete --name jshu-sts3 --region=us-east-2
...
2023/06/22 12:27:44 Identity Provider bucket jshu-sts3-oidc deleted
2023/06/22 12:27:54 Waiting 30s for CloudFront distribution with ID E1JUIQ3GZNMFP2 to be disabled...
2023/06/22 12:28:24 Waiting 30s for CloudFront distribution with ID E1JUIQ3GZNMFP2 to be disabled...
...
2023/06/22 12:35:59 CloudFront distribution with ID E1JUIQ3GZNMFP2 deleted
2023/06/22 12:36:00 CloudFront origin access identity with ID E2WDDMOY5FRX91 deleted
...

      Version-Release number of selected component (if applicable):

      4.21

      How reproducible:

      always

      Steps to Reproduce:

          1.ccoctl aws create-all --create-private-s3-bucket --name jshuaws11 --region us-east-1 --output-dir output11 --credentials-requests-dir /home/cloud-user/jshu/cco/awscr-420
    2.ccoctl aws delete --name jshuaws11 --region us-east-1

      Actual results:

      CloudFront Distribution and origin access identity NOT deleted
like
2025/10/26 21:49:25 failed to delete the CloudFront origin access identity with ID E3I4QD2PBVGYZ6: operation error CloudFront: DeleteCloudFrontOriginAccessIdentity, https response error StatusCode: 409, RequestID: c93445d3-673d-4d3d-a37a-641827cea46a, CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.    

      Expected results:

      CloudFront Distribution and origin access identity deleted
like
2023/06/22 12:35:59 CloudFront distribution with ID E1JUIQ3GZNMFP2 deleted 2023/06/22 12:36:00 CloudFront origin access identity with ID E2WDDMOY5FRX91 deleted    

      Additional info:

      I tested 4.21/4.20/4.16

              jstuever@redhat.com Jeremiah Stuever
              jshu@redhat.com Jianping Shu
              None
              None
              Jianping Shu Jianping Shu
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: