Access Denied when calling the CreateInvalidation operation on AWS CLI.

If you are getting access denied when calling the CreateInvalidation operation on AWS CLI, it must be a permission issue for that user. 

In this post, I am using the Jenkins pipeline to build and pushing the artifacts into S3. I am using CloudFront for Content Delivery Network (CDN) and hosting my web site in Route 53. 

When I am trying to do the CloudFront Distribution invalidate the cache from CLI, I am getting this below error. I thought to add some screenshot to get more visibility, so added below.

Error Log:-

A client error (AccessDenied) occurred when calling the CreateInvalidation operation: User: arn:aws:iam::xxxxxxxxxxx:user/yyyy is not authorized to perform: cloudfront:


The below command I am using from AWS CLI :

aws configure set preview.cloudfront true

aws cloudfront create-invalidation --distribution-id UJH89JKKMOVY340 --paths "/*"    

Resolution:-

Add the "CreateInvalidation" permission to that user. Below are the steps to add the permission.

• Goto Identity and Access Management (IAM) 
• Goto Users and find your username, here for me its "Jenkins"
• Then add a new "Add Inline policy", below the screenshot.

• Now add the below policy into the JSON policy editor. Below the screenshot.

Policy JSON:-

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditoro",
            "Effect": "Allow",
            "Action": "cloudfront:CreateInvalidation",
            "Resource": "arn:aws:cloudfront::17088938460999:distribution/UJH89JKKMOVY340"
        }
    ]
}

Sample Screenshot:-

Now, it's working fine. I can see the Jenkins logs below.

Jenkins Success Log:-

; perhaps you meant to use ‘PATH+EXTRA=/something/bin’?
+ aws configure set preview.cloudfront true
[Pipeline] sh
Warning: JENKINS-41339 probably bogus PATH=/var/lib/jenkins/tools/jenkins.plugins.nodejs.tools.NodeJSInstallation/node-v10.16.3-linux-x64/bin:/var/lib/jenkins/tools/hudson.model.JDK/JDK8-152/bin:$PATH:/usr/local/bin:$MAVEN_HOME/bin:/usr/local/bin:/var/lib/jenkins/tools/hudson.tasks.Maven_MavenInstallation/mvn/bin:/usr/sbin:/usr/bin:/sbin:/bin; perhaps you meant to use ‘PATH+EXTRA=/something/bin’?
+ aws cloudfront create-invalidation --distribution-id UJH89JKKMOVY340 --paths '/*'
{
    "Invalidation": {
        "Status": "InProgress", 
        "InvalidationBatch": {
            "Paths": {
                "Items": [
                    "/*"
                ], 
                "Quantity": 1
            }, 
            "CallerReference": "cli-1588239578-85708"
        }, 
        "Id": "I3HILN71CKWOV4", 
        "CreateTime": "2020-04-30T09:39:38.919Z"
    }, 
    "Location": "https://cloudfront.amazonaws.com/2019-03-26/distribution/UJH89JKKMOVY340/invalidation/I3HILN71CKWOV4"
}

Hope this will help you. 

Follow for more details on Google+ and @Facebook!!!

Find More:-

• How to get aws access key id and secret access.
• Top 10 groovy interview question.
• Difference between groovy and java.
• What is full stack development experience.
• 5 fundamental questions of groovy.
• Write your first java program.
• Reverse string using recursive method in java.
• Java 8 use Option - avoid NullPointerException
• GetIntents Error for lex runtime