Our incident: CloudFront needs account verification

Symptom

MiniTickets’ deploy notes record CloudFront blocked pending account verification. A representative AWS error is Your account must be verified before you can add new CloudFront resources. The notes do not preserve the original full error line or a completed verification.

Read the error first

CloudFront rejects resource creation before an edge distribution exists. This is Allowed at the account/service level, not an origin Reach failure or application Password issue. Read the explanation after AccessDenied: missing IAM permission, explicit policy deny and account verification need different repairs.

Decide

flowchart TB
  A[CloudFront creation denied] --> B{Error names account verification?}
  B -->|yes| C[Confirm account and contact AWS Support]
  B -->|no| D[Inspect IAM, SCP and error detail]
  C --> E{Need a usable app now?}
  E -->|yes| F[Use reviewed ALB-only mode]
  E -->|no| G[Wait for AWS decision]

Likely causes

Rank by the actual wording:

1. Verification named: an account restriction. More IAM grants do not complete verification.
2. Policy denial named: the deploy role lacks the requested CloudFront action or a policy explicitly denies it.
3. Unexpected account: credentials target a different account than intended. Confirm identity before asking Support about it.

How to check

Console

Read the failed deploy’s exact error and request ID, if retained. Confirm the account menu, CloudFront → Distributions, and existing AWS Support correspondence. Absence of a distribution alone does not identify the cause.

CLI

These identify the current account and distribution metadata; neither proves permission to create.

export AWS_PROFILE=ticketlite
aws sts get-caller-identity
aws cloudfront list-distributions --query 'DistributionList.Items[].{Id:Id,Comment:Comment,Status:Status}'
aws cloudtrail lookup-events --region us-east-1 --lookup-attributes AttributeKey=EventSource,AttributeValue=cloudfront.amazonaws.com --query 'Events[].{Time:EventTime,Name:EventName,Id:EventId}'

CloudTrail

Inspect CreateDistribution or CreateDistributionWithTags near the failure: caller, errorCode, errorMessage and request ID. CloudFront global API events appear in us-east-1. Event history has limited retention; the deploy log may be the surviving evidence.

Fix

Ask AWS Support to review the account restriction, including the error and request ID. MiniTickets instead keeps the app reachable through its supported ALB-only mode: cdnEnabled: false, an ACM certificate and its own domain. No verification resolution is claimed. CloudFront’s chapter explains both paths.

Prevent

Check account/service readiness before depending on a CDN launch. Keep the fallback tested. Switch modes only while entry is off: both modes use listener port 80. See infra/src/entry/https-listener.ts → createHttpsListener.

Say it in 30 seconds

Say it like this (20-30 seconds)

Our deploy notes record a CloudFront account-verification blocker. That is a service restriction, so adding application permissions would not resolve it. I would preserve the precise error, confirm the account and take the request to AWS Support. MiniTickets has a supported alternative: the ALB terminates HTTPS with ACM on our domain. CloudFront remains disabled in committed config. I would check account readiness before making it a launch dependency and verify mode changes safely.

Advanced: What the incident record does and does not establish

The frozen deploy-day notes say CloudFront remains inactive pending account verification. They do not retain a request ID, Support case category, completion date or original full error transcript. The quoted phrase above is a representative AWS service message, also preserved in an AWS-owned example repository issue; it is not presented as our recovered original log.

Current code is authoritative for behavior: infra/src/entry/cdn.ts → createCdn defines CloudFront mode, infra/src/entry/https-listener.ts → createHttpsListener defines direct HTTPS, and infra/Pulumi.dev.yaml selects the direct mode. The committed domain is minitickets.theversehub.in. Its certificate and DNS records have their own validation requirements, separate from CloudFront account verification.

AWS documents CloudFront API events and their region. Do not print a distribution’s origin custom-header value while investigating; listing distribution metadata is enough for the checks above.