CloudFront get redeployed every time if forward custom headers

[ghost]

This issue was originally opened by @JoeShi as hashicorp/terraform#20881. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.11.13

Terraform Configuration Files

resource "aws_s3_bucket" "aos_bucket_cf" {
  bucket = "${var.aos_bucket_cf_name}"
  region = "${var.region}"
}

locals {
  s3_origin_id = "aos_bucket_cf"
}

resource "aws_cloudfront_distribution" "aos_cf" {
  origin {
    domain_name = "${aws_s3_bucket.aos_bucket_cf.bucket_regional_domain_name}"
    origin_id = "${local.s3_origin_id}"
  }
  enabled = true
  is_ipv6_enabled = false
  comment = "AOS CloudFront"
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods = ["GET", "HEAD"]
    cached_methods = ["GET", "HEAD"]
    forwarded_values {
      cookies {
        forward = "none"
      }
      query_string = true
      headers      = ["Accept-Language", "Referer", "CloudFront-Viewer-Country", "User-Agent"]
    }
    target_origin_id = "${local.s3_origin_id}"
    viewer_protocol_policy = "allow-all"
    min_ttl = 0
    max_ttl = 0
    default_ttl = 0
    lambda_function_association {
      event_type = "origin-request"
      lambda_arn = "arn:aws:lambda:us-east-1:${data.aws_caller_identity.current.account_id}:function:aos-${var.version}-index:${var.aos_lambda_edge_index_version}"
    }
  }

  price_class = "PriceClass_All"

  restrictions {
    "geo_restriction" {
      restriction_type = "none"
    }
  }

  "viewer_certificate" {
    cloudfront_default_certificate = true
  }
}

Debug Output

Additional Context

  ~ aws_cloudfront_distribution.aos_cf
      default_cache_behavior.0.forwarded_values.0.headers.1: "CloudFront-Viewer-Country" => "Referer"
      default_cache_behavior.0.forwarded_values.0.headers.2: "Referer" => "CloudFront-Viewer-Country"

Expected Behavior

CloudFront distribution should NOT refresh.

Actual Behavior

CloudFront distribution refreshed every time after a terraform apply

Steps to Reproduce

terraform init
terraform apply

• Add issue_template terraform#6017

[bflad]

Hi @JoeShi 👋 Thanks for submitting this and sorry you are running into trouble here. This appears to be a duplicate of #7867 so to consolidate efforts and discussions I'm going to close this issue in preference of the existing issue. Please feel free to 👍 upvote and subscribe there. The good news is that we are planning on addressing this later this week once #8116 is merged in.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!