New action: aws_cloudfront_create_invalidation

[YakDriver]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

This PR introduces a new Terraform action that allows users to invalidate a CloudFront distribution cache for specified paths. The action creates an invalidation request via the AWS CloudFront API and waits for it to complete, providing real-time progress updates throughout the process. Users can specify individual files, directory wildcards, or invalidate all cached content, with configurable timeouts and optional caller references for tracking.

The action is designed for common CI/CD workflows where cache invalidation is needed after deploying updated static assets. It integrates seamlessly with terraform_data lifecycle triggers, enabling automatic cache invalidation during infrastructure updates. The implementation includes comprehensive validation, error handling for CloudFront-specific scenarios (like too many concurrent invalidations), and follows the established AWS provider patterns for actions with proper documentation and acceptance tests.

resource "aws_cloudfront_distribution" "example" {
  # ... distribution configuration
}

action "aws_cloudfront_create_invalidation" "example" {
  config {
    distribution_id = aws_cloudfront_distribution.example.id
    paths           = ["/*"]
  }
}

resource "terraform_data" "example" {
  input = "trigger-invalidation"

  lifecycle {
    action_trigger {
      events  = [before_create, before_update]
      actions = [action.aws_cloudfront_create_invalidation.example]
    }
  }
}

Relations

Relates #43700
Relates #43972
Depends on #43669

References

Output from Acceptance Testing

% make t T=TestAccCloudFrontCreateInvalidationAction_basic K=cloudfront
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.24.6 test ./internal/service/cloudfront/... -v -count 1 -parallel 20 -run='TestAccCloudFrontCreateInvalidationAction_basic'  -timeout 360m -vet=off
2025/08/19 16:25:11 Creating Terraform AWS Provider (SDKv2-style)...
2025/08/19 16:25:11 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCloudFrontCreateInvalidationAction_basic
=== PAUSE TestAccCloudFrontCreateInvalidationAction_basic
=== CONT  TestAccCloudFrontCreateInvalidationAction_basic
--- PASS: TestAccCloudFrontCreateInvalidationAction_basic (541.27s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront	549.580s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.