From 23cac358bc245c8b1fcc1c74bb779fee3c20b0b9 Mon Sep 17 00:00:00 2001 From: mellowcroc Date: Fri, 21 Aug 2026 03:40:51 +0900 Subject: [PATCH] fix(storage-setup): correct the OAC reuse lookup in setup-aws.sh list-origin-access-controls returns flattened summaries whose Name is a top-level field, but the reuse lookup filtered on OriginAccessControlConfig.Name, which matches nothing. The query therefore always returned None, the script always attempted create-origin-access-control, and any rerun over existing infrastructure died with OriginAccessControlAlreadyExists - contradicting the documented rerun-safety ('reuses the named buckets, OAC, distribution'). First runs worked, which is why the miss went unnoticed; rerun adoption never did. Filter on the summary's top-level Name instead. The neighbouring distribution lookup already filters on the summary's flat Comment field and is unaffected. Found by rerunning the guided setup over the existing relay-ceremony infrastructure during the published-kit documentation pass on 2026-08-21. --- scripts/storage-setup/setup-aws.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/storage-setup/setup-aws.sh b/scripts/storage-setup/setup-aws.sh index 28ea535..f32ea08 100755 --- a/scripts/storage-setup/setup-aws.sh +++ b/scripts/storage-setup/setup-aws.sh @@ -224,7 +224,7 @@ create_bucket "$INBOX_BUCKET" oac_name="relay-${PUBLISHED_BUCKET:0:40}-${setup_account}-oac" oac_id=$(aws --profile "$AWS_PROFILE" cloudfront list-origin-access-controls \ - --query "OriginAccessControlList.Items[?OriginAccessControlConfig.Name=='$oac_name'].Id | [0]" --output text) + --query "OriginAccessControlList.Items[?Name=='$oac_name'].Id | [0]" --output text) if [[ -z "$oac_id" || "$oac_id" == None ]]; then printf 'Creating CloudFront origin access control\n' oac_id=$(aws --profile "$AWS_PROFILE" cloudfront create-origin-access-control \