Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-65479

CloudFront Distribution not deleted by ccoctl aws delete

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.16, 4.17, 4.18, 4.19, 4.20, 4.21
    • Cloud Credential Operator
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Rejected
    • None
    • In Progress
    • Bug Fix
    • Hide
      Previously, the ccoctl utility did not support pagination when retrieving CloudFront distributions. As a result, if the distribution to be deleted was not included in the first batch of results, the CloudFront distribution and its associated origin access identity could not be deleted successfully during the ccoctl aws delete operation.
      This update adds pagination support to the ccoctl utility when fetching CloudFront distributions, ensuring that the distribution can be located and deleted properly.
      Show
      Previously, the ccoctl utility did not support pagination when retrieving CloudFront distributions. As a result, if the distribution to be deleted was not included in the first batch of results, the CloudFront distribution and its associated origin access identity could not be deleted successfully during the ccoctl aws delete operation. This update adds pagination support to the ccoctl utility when fetching CloudFront distributions, ensuring that the distribution can be located and deleted properly.
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-65478. The following is the description of the original issue:
      —
      This is a clone of issue OCPBUGS-63690. The following is the description of the original issue:
      —
      This is a clone of issue OCPBUGS-63561. The following is the description of the original issue:
      —
      Description of problem:

      CloudFront Distribution not deleted by ccoctl aws delete.
Compared the logs, seems it didn't get the distribution by tags successfully.
Current log:
[cloud-user@preserved-jshu verify]$ ./ccoctl aws delete --name jshuaws11 --region us-east-1
...
2025/10/26 21:49:05 Identity Provider bucket jshuaws11-oidc deleted
2025/10/26 21:49:25 failed to delete the CloudFront origin access identity with ID E3I4QD2PBVGYZ6: operation error CloudFront: DeleteCloudFrontOriginAccessIdentity, https response error StatusCode: 409, RequestID: c93445d3-673d-4d3d-a37a-641827cea46a, CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.
2025/10/26 21:49:40 Policy jshuaws11-openshift-cloud-credential-operator-cloud-credential-o associated with IAM Role jshuaws11-openshift-cloud-credential-operator-cloud-credential-o deleted
...

Old successful log:
[cloud-user@jshu-gcp cco]$ ./ccoctl aws delete --name jshu-sts3 --region=us-east-2
...
2023/06/22 12:27:44 Identity Provider bucket jshu-sts3-oidc deleted
2023/06/22 12:27:54 Waiting 30s for CloudFront distribution with ID E1JUIQ3GZNMFP2 to be disabled...
2023/06/22 12:28:24 Waiting 30s for CloudFront distribution with ID E1JUIQ3GZNMFP2 to be disabled...
...
2023/06/22 12:35:59 CloudFront distribution with ID E1JUIQ3GZNMFP2 deleted
2023/06/22 12:36:00 CloudFront origin access identity with ID E2WDDMOY5FRX91 deleted
...

      Version-Release number of selected component (if applicable):

      4.21

      How reproducible:

      always

      Steps to Reproduce:

          1.ccoctl aws create-all --create-private-s3-bucket --name jshuaws11 --region us-east-1 --output-dir output11 --credentials-requests-dir /home/cloud-user/jshu/cco/awscr-420
    2.ccoctl aws delete --name jshuaws11 --region us-east-1

      Actual results:

      CloudFront Distribution and origin access identity NOT deleted
like
2025/10/26 21:49:25 failed to delete the CloudFront origin access identity with ID E3I4QD2PBVGYZ6: operation error CloudFront: DeleteCloudFrontOriginAccessIdentity, https response error StatusCode: 409, RequestID: c93445d3-673d-4d3d-a37a-641827cea46a, CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.    

      Expected results:

      CloudFront Distribution and origin access identity deleted
like
2023/06/22 12:35:59 CloudFront distribution with ID E1JUIQ3GZNMFP2 deleted 2023/06/22 12:36:00 CloudFront origin access identity with ID E2WDDMOY5FRX91 deleted    

      Additional info:

      I tested 4.21/4.20/4.16

              jstuever@redhat.com Jeremiah Stuever
              jshu@redhat.com Jianping Shu
              None
              None
              Jianping Shu Jianping Shu
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: