AWS CloudFront "NoSuchDistribution" (distribution not found) in CI

By Daniel Zoghalchali·Latchkey

CloudFront could not find the distribution: "NoSuchDistribution" means the --distribution-id you passed does not exist under the credentials in use, usually a stale id, a typo, or a token for a different account.

What this error means

aws cloudfront create-invalidation fails with "An error occurred (NoSuchDistribution) when calling the CreateInvalidation operation: The specified distribution does not exist."

An error occurred (NoSuchDistribution) when calling the CreateInvalidation operation:
The specified distribution does not exist.

Common causes

The distribution id is stale or misspelled

A hard-coded or copied id no longer matches an existing distribution (recreated, or a typo), so CloudFront reports it as nonexistent.

The credentials are for a different account

The distribution lives in one AWS account, but the CI role is in another, so the id is not visible to it.

How to fix it

Resolve the id from a stable input

1. List distributions and confirm the id and its domain.
2. Read the id from a secret or a Terraform output rather than hard-coding it.
3. Confirm the CI credentials belong to the owning account.

aws cloudfront list-distributions \
  --query "DistributionList.Items[].{id:Id,domain:DomainName}" --output table

Verify the account matches

Check the caller account against the account that owns the distribution.

aws sts get-caller-identity --query Account --output text

How to prevent it

• Source the distribution id from infra outputs or a secret, not a literal.
• Confirm the CI role account owns the distribution.
• Validate the id with a list/get call in a preflight step.

Frequently asked questions

Related guides

References

• GitHub Actions documentation