cloudfront: Failed to forward Authorization header from cloudfront to API Gateway

I am using distribution HTTP API with cloudfront. And I want to pass Authorization header from cloudfront to HTTP API lambda authorizer. And I am not able to whitelist any header from cloudfront.

Reproduction Steps

In brand new CDK Projest just create the following policy

    new OriginRequestPolicy(this, 'testOriginPolicy', {
      cookieBehavior: OriginRequestCookieBehavior.all(),
      headerBehavior: OriginRequestHeaderBehavior.allowList('Authorization'),
      queryStringBehavior: OriginRequestQueryStringBehavior.all()
    })

What did you expect to happen?

I expcted to successfully deploy the origin policy. I haven’t even attached to cloudfront distribution yet.

What actually happened?

The deploy fails with following error

Invalid request provided: AWS::CloudFront::OriginRequestPolicy
The following resource(s) failed to create: [testOriginPolicyBBC7F32C].

Environment

• CDK CLI Version : 1.91.0
• Framework Version:
• Node.js Version: v14.16.0
• OS : Ubuntu 20.04 on WSL2
• Language (Version): Typescript ~3.9.7

Other

---

This is 🐛 Bug Report

[njlynch]

I would like help setting Cache Policy because its for API endpoint I have been using static CachePolicy.CACHING_DISABLED. Now to allow Headers I need to recreate the CACHING_DISABLED and add whitelist for header.

This is actually reasonably straightforward. Simply create a new CachePolicy with 0s for all TTLs, and add the header policy. Then use this new cache policy with your distribution.

const cachePolicy = new cloudfront.CachePolicy(stack, 'CachingDisabledButWithAuth', {
  defaultTtl: Duration.minutes(0),
  minTtl: Duration.minutes(0),
  maxTtl: Duration.minutes(0),
  headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization'),
});

[bblanke]

Quick addition to @njlynch 's response. I had to set at least 1 of the TTL’s to something in order to create the cache policy, so I set max TTL to 1 second:

const cachePolicy = new cloudfront.CachePolicy(stack, 'CachingDisabledButWithAuth', {
  defaultTtl: Duration.minutes(0),
  minTtl: Duration.minutes(0),
  maxTtl: Duration.minutes(1),
  headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization'),
});