Skip to content

Conversation

alukach
Copy link
Contributor

@alukach alukach commented Jul 3, 2025

What I'm Changing

When deploying to production, we received an error from CloudFormation when creating a CloudFrontSigningPublicKey:

Invalid request provided: AWS::CloudFront::PublicKey: The parameter CallerReference is too big. (Service: CloudFront, Status Code: 400, Request ID: 86f88058-6d61-4b38-809d-b62f9cc9837f) (SDK Attempt Count: 1)

This is due to the fact that in our code to create a CloudFrontSigningPublicKey we create a long composite value:

animl-ingest/serverless.yml

Lines 480 to 488 in ef7fc9c

CloudFrontSigningPublicKey:
Type: AWS::CloudFront::PublicKey
DependsOn: KeyGenerator
Properties:
PublicKeyConfig:
CallerReference: !Sub '${AWS::Region}-${AWS::AccountId}-${AWS::StackId}'
Comment: animl-images-serving-${opt:stage, self:provider.stage, 'dev'}
EncodedKey: !GetAtt KeyGenerator.PublicKey
Name: AnimlServiceKey-${opt:stage, self:provider.stage, 'dev'}

Reviewing the docs1, we see that the AWS::StackId is an ARN of the CloudFormation stack:

Returns the ID (ARN) of the stack, such as arn:aws:cloudformation:us-west-2:123456789012:stack/teststack/51af3dc0-da77-11e4-872e-1234567db123.

Appending this to the other values likely places us over character limits. This PR shortens the CallerReference value

How I Did It

The docs2 for a CallerReference describes as such:

A string included in the request to help make sure that the request can't be replayed.

So the particular value of the string does not seem important, aside from it being unique per deployment (ie we wouldn't want two stacks to both be deploying and competing for the same CallerReference value).

Given this, I think we'd be fine by simply using the AWS::StackName value.

Footnotes

  1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-stackid

  2. https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-publickey-publickeyconfig.html#cfn-cloudfront-publickey-publickeyconfig-callerreference

@nathanielrindlaub nathanielrindlaub merged commit f14e173 into master Jul 3, 2025
3 checks passed
@nathanielrindlaub nathanielrindlaub deleted the fix/callerreference-too-big branch July 3, 2025 23:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants