(CloudFront): Initial Create Succeeds, Subsequent Updates Fail with Invalid request provided: AWS::CloudFront::PublicKey

The following code will create a proper Cloudfront PublicKey and it is usable to restrict access to private resources.

But, any updates to the stack that update the CloudFront PublicKey will fail with:

Resource handler returned message: "Invalid request provided: AWS::CloudFront::PublicKey" (RequestToken: fd28451c-389a-cdd8-d3f7-2bb76874bfee, HandlerErrorCode: InvalidRequest)

Reproduction Steps

        cloudfront_public_key = cloudfront.PublicKey(
            self, "cloudfront-public-key",
            encoded_key=<generated_public_key>
        )
        cloudfront_keygroup = cloudfront.KeyGroup(
            self, "cloudfront-keygroup",
            items=[cloudfront_public_key]
        )

What did you expect to happen?

I would expect the PublicKey to update without error.

What actually happened?

Environment

• **CDK CLI Version : ** 1.108.0 (build b23f781)
• Framework Version: 1.108.0 (build b23f781)
• Node.js Version: v12.18.2
• OS : CodeBuild/CodePipeline
• Language (Version): Python 3.7.4

Other

---

This is 🐛 Bug Report

[comcalvi]

We’re still investigating this issue. A potential workaround now would be to change the logical ID of the public key, which will force a new one to be created with the correct properties.

[salvo-audvice]

+1