AWS CloudFront create-invalidation AccessDenied in CI

By Daniel Zoghalchali·Latchkey

The AWS CLI reached CloudFront but the identity is not permitted to invalidate: "AccessDenied ... CreateInvalidation" means the CI role or user is missing the cloudfront:CreateInvalidation permission for the distribution.

What this error means

aws cloudfront create-invalidation fails with "An error occurred (AccessDenied) when calling the CreateInvalidation operation: User ... is not authorized to perform: cloudfront:CreateInvalidation".

An error occurred (AccessDenied) when calling the CreateInvalidation operation:
User: arn:aws:sts::123456789012:assumed-role/ci-deploy/GitHubActions is not authorized to
perform: cloudfront:CreateInvalidation on resource: arn:aws:cloudfront::123456789012:distribution/E123ABC

Common causes

The CI role policy omits CreateInvalidation

A deploy role scoped only to S3, or to CloudFront read actions, cannot create invalidations, so the CLI is denied.

A resource condition excludes this distribution

The policy grants the action but only on other distribution ARNs, so this specific distribution is denied.

How to fix it

Grant CreateInvalidation on the distribution

1. Add cloudfront:CreateInvalidation (and GetInvalidation to poll) to the CI role.
2. Scope the resource to the distribution ARN you deploy.
3. Re-run the deploy so the invalidation is authorized.

{
  "Effect": "Allow",
  "Action": ["cloudfront:CreateInvalidation", "cloudfront:GetInvalidation"],
  "Resource": "arn:aws:cloudfront::123456789012:distribution/E123ABC"
}

Confirm the assumed identity

Verify the CLI is using the role you expect before debugging permissions.

aws sts get-caller-identity

How to prevent it

• Include CreateInvalidation and GetInvalidation in the deploy role.
• Scope the resource ARN to the exact distribution.
• Assert get-caller-identity so a wrong role is caught early.

Frequently asked questions

Related guides

References

• GitHub Actions documentation