Cloudfront cannot invalidate paths that contain a tilde ~ character

[danludwig-happymoney]

Describe the bug

When trying to invalidate a cloudfront path that contains a tilde ~ character, cloudfront rejects the CreateInvalidation request with an invalid argument error. Encoding the tilde as %7E does not error like this, but also does not invalidate the desired path(s). Invoking encodeURI or encodeURIComponent on the path does not URL encode any tildes.

Expected Behavior

Expect cloudfront to allow the invalidation of paths that contain a tilde character, or for an explanation of how to do so, or for a reason that it cannot be supported.

Current Behavior

unhandledRejection InvalidArgument: Your request contains one or more invalid invalidation paths. at deserializeAws_restXmlInvalidArgumentResponse ... '$fault': 'client', '$metadata': { httpStatusCode: 400, requestId: '55165787-1a8f-474b-b747-b7c4541e9972', extendedRequestId: undefined, cfId: undefined, attempts: 1, totalRetryDelay: 0 }, Type: 'Sender', Code: 'InvalidArgument'

Reproduction Steps

Create a standard cloudfront distribution backed by an S3 origin.

Do the storybook tutorial, or somehow build a storybook static site. It will contain files named something like runtime~main.{hash}.{something}.bundle.js.

Publish the storybook static site to S3/cloudfront.

Try to create an invalidation that contains any of the paths that contain a tilde character. The web console also returns an error, so it may not be coming from the js sdk.

Possible Solution

Only workaround I have found so far is to replace the first tilde character with an asterisk, then chop off the rest of the string. This works to invalidate files that must be invalidated, but may also inadvertently invalidate paths that would be better optimized by remaining cached.

Additional Information/Context

No response

SDK version used

@aws-sdk/client-cloudfront@^3.186.0

Environment details (OS name and version, etc.)

macOS Big Sur Version 11.4

[danludwig-happymoney]

@ajredniwja Hi, just following up to see if there is anything you can tell me about this?

[zoltanburgermeiszter-e2x]

@ajredniwja Is there any update regarding this issue?

[RanVaknin]

Hi @danludwig-happymoney ,

I have reproduced this issue and can confirm this is a bug.

Reproduction:

import { CloudFrontClient, CreateInvalidationCommand } from "@aws-sdk/client-cloudfront"; 

const client = new CloudFrontClient("us-east-1");

try {
    await client.send(new CreateInvalidationCommand({
        DistributionId: "my-distribution-id",
        InvalidationBatch: {
            CallerReference: "foo-bar",
            Paths: {
                Quantity: 1,
                Items: [("/baz/~")]
            },
        },
    }))
} catch (error) {
    console.log(error)
}

InvalidArgument: Your request contains one or more invalid invalidation paths.
    at deserializeAws_restXmlInvalidArgumentResponse (/Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/client-cloudfront/dist-cjs/protocols/Aws_restXml.js:8225:23)
    at deserializeAws_restXmlCreateInvalidationCommandError (/Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/client-cloudfront/dist-cjs/protocols/Aws_restXml.js:3593:25)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async /Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/middleware-serde/dist-cjs/deserializerMiddleware.js:7:24
    at async /Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/middleware-signing/dist-cjs/middleware.js:14:20
    at async /Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/middleware-retry/dist-cjs/retryMiddleware.js:27:46
    at async /Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/node_modules/@aws-sdk/middleware-logger/dist-cjs/loggerMiddleware.js:7:26
    at async file:///Users/REDACTED/test_folder/4042-cloudfront-invalidatecache/sample.js:11:5 {

Assigning needs-review for SDEs to take a look. Thanks, Ran~

[RanVaknin]

Update: This is due to a service side limitation. I will open a ticket with the service team.

Thanks, Ran~

P86921957

[RanVaknin]

Hi @danludwig-happymoney ,

We have finally heard back from the service team:

Invalidations using some Non-ASCII or unsafe characters such as ~ in the path does not work even after URL encoding. Please use other workarounds such as using the wildcard character while invalidating content for now. We will update our documentation to reflect the current behavior of invalidations.

From the sound of it, this is a limitation with the service. Since the SDK cannot do anything regarding this issue and is not actionable, Im going to close it.

Thanks for your patience,

All the best, Ran~

[github-actions[bot]]

This issue is now closed.

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.