Cloudfront update behavior issue

[niqo01]

Describe the bug

I am trying to add a cloudfront behavior using kotlin sdk kotlin v1.4.92.
However when trying to send the updated config I get the error:

You must specify IncludeCookies when Enabled is missing or set to true within a Logging object

Regression Issue

• Select this option if this issue appears to be a regression.

Expected behavior

New cloud front behavior updated correctly.

Current behavior

IllegalUpdate(message=You must specify IncludeCookies when Enabled is missing or set to true within a Logging object)
--
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.model.IllegalUpdate$Builder.build(IllegalUpdate.kt:57)
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.serde.IllegalUpdateDeserializer.deserialize(IllegalUpdateDeserializer.kt:29)
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.serde.UpdateDistributionOperationDeserializerKt.throwUpdateDistributionError(UpdateDistributionOperationDeserializer.kt:96)
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.serde.UpdateDistributionOperationDeserializerKt.access$throwUpdateDistributionError(UpdateDistributionOperationDeserializer.kt:1)
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.serde.UpdateDistributionOperationDeserializer.deserialize(UpdateDistributionOperationDeserializer.kt:22)
  | 2025-06-05T08:21:40.398Z | at aws.sdk.kotlin.services.cloudfront.serde.UpdateDistributionOperationDeserializer.deserialize(UpdateDistributionOperationDeserializer.kt:17)
  | 2025-06-05T08:21:40.398Z | at aws.smithy.kotlin.runtime.http.operation.DeserializeHandler.call(SdkOperationExecution.kt:347)
  | 2025-06-05T08:21:40.398Z | at aws.smithy.kotlin.runtime.http.operation.DeserializeHandler$call$1.invokeSuspend(SdkOperationExecution.kt)
  | 2025-06-05T08:21:40.398Z | at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:100)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.EventLoopImplBase.processNextEvent(EventLoop.common.kt:263)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.BlockingCoroutine.joinBlocking(Builders.kt:94)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking(Builders.kt:70)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.BuildersKt.runBlocking(Unknown Source)
  | 2025-06-05T08:21:40.398Z | at kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking$default(Builders.kt:48)
  | 2025-06-05T08:21:40.399Z | at kotlinx.coroutines.BuildersKt.runBlocking$default(Unknown Source)
  | 2025-06-05T08:21:40.399Z | at enkihangouts.customresource.functions.CustomResourceHandler.update(CustomResourceHandler.kt:53)
  | 2025-06-05T08:21:40.399Z | at software.amazon.lambda.powertools.cloudformation.AbstractCustomResourceHandler.getResponse(AbstractCustomResourceHandler.java:103)
  | 2025-06-05T08:21:40.399Z | at software.amazon.lambda.powertools.cloudformation.AbstractCustomResourceHandler.handleRequest(AbstractCustomResourceHandler.java:72)
  | 2025-06-05T08:21:40.399Z | at software.amazon.lambda.powertools.cloudformation.AbstractCustomResourceHandler.handleRequest(AbstractCustomResourceHandler.java:1)
  | 2025-06-05T08:21:40.399Z | at com.amazonaws.services.lambda.runtime.api.client.EventHandlerLoader$PojoHandlerAsStreamHandler.handleRequest(EventHandlerLoader.java:655)
  | 2025-06-05T08:21:40.399Z | at com.amazonaws.services.lambda.runtime.api.client.EventHandlerLoader$2.call(EventHandlerLoader.java:601)
  | 2025-06-05T08:21:40.399Z | at com.amazonaws.services.lambda.runtime.api.client.AWSLambda.startRuntime(AWSLambda.java:240)
  | 2025-06-05T08:21:40.399Z | at com.amazonaws.services.lambda.runtime.api.client.AWSLambda.startRuntime(AWSLambda.java:190)
  | 2025-06-05T08:21:40.399Z | at com.amazonaws.services.lambda.runtime.api.client.AWSLambda.main(AWSLambda.java:180)

Steps to Reproduce

1. Create an Aws Distribution.
   my current cdk code is:

Distribution.Builder.create(
        this,
        "CdnDistribution",
      )
        .defaultBehavior(
          BehaviorOptions.Builder()
            .origin(S3BucketOrigin.withOriginAccessControl(props.staticAssetsBucket))
            .viewerProtocolPolicy(ViewerProtocolPolicy.HTTPS_ONLY)
            .responseHeadersPolicy(noIndexHeaderPolicy())
            .build(),
        )
        .priceClass(if (props.appEnv.isProd)PriceClass.PRICE_CLASS_ALL else PriceClass.PRICE_CLASS_100)
        .certificate(props.certificate)
        .sslSupportMethod(SSLMethod.SNI)
        .minimumProtocolVersion(SecurityPolicyProtocol.TLS_V1_2_2021)
        .domainNames(aliases) 
        .enableLogging(true)
        .logBucket(logBucket)
        .logFilePrefix("cdn-cloudfront/")
        .logIncludesCookies(false)
        .webAclId(props.webAclId)
        .errorResponses(
          listOf(
            ErrorResponse.builder().httpStatus(500).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(501).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(502).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(503).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(504).ttl(Duration.minutes(10)).build(),
          ),
        )
        .build()

2. Later try to alter the distribution with the goal to add a new behavior. Currently my code running in a java lambda is:

suspend fun addOrUpdateBehavior(
    distributionId: String,
    functionArn: String,
    originDomainName: String,
    originPath: String,
    pathPattern: String,
    cachePolicyId: String,
    originRequestPolicyId: String,
  ) {
    val distConfigResp = clClient.getDistributionConfig {
      id = distributionId
    }

    val config = distConfigResp.distributionConfig!!
    val etag = distConfigResp.eTag!!

    val originId = "custom-${originDomainName.lowercase().replace(Regex("[^a-z0-9-]"), "-")}"

    val originExists = config.origins?.items?.any { it.id == originId } ?: false

    val newOrigins = if (!originExists) {
      logger.info { "Adding new origin $originId with domain $originDomainName and path $originPath" }
      val updatedItems = (config.origins?.items ?: emptyList()).toMutableList()
      updatedItems.add(
        Origin {
          id = originId
          domainName = originDomainName
          this.originPath = originPath
          customOriginConfig = CustomOriginConfig {
            httpPort = 80
            httpsPort = 443
            originProtocolPolicy = OriginProtocolPolicy.HttpsOnly
            originSslProtocols = OriginSslProtocols {
              quantity = 1
              items = listOf(SslProtocol.TlsV1_2)
            }
          }
        },
      )
      Origins {
        quantity = updatedItems.size
        items = updatedItems
      }
    } else {
      config.origins!!
    }

    val newBehavior = CacheBehavior {
      this.pathPattern = pathPattern
      this.targetOriginId = originId
      this.viewerProtocolPolicy = ViewerProtocolPolicy.RedirectToHttps
      this.allowedMethods = AllowedMethods {
        quantity = 2
        items = listOf(Method.Get, Method.Head)
        cachedMethods = CachedMethods {
          quantity = 2
          items = listOf(Method.Get, Method.Head)
        }
      }
      this.compress = true
      this.cachePolicyId = cachePolicyId
      this.originRequestPolicyId = originRequestPolicyId
      this.functionAssociations = FunctionAssociations {
        quantity = 1
        items = listOf(
          FunctionAssociation {
            eventType = EventType.ViewerRequest
            this.functionArn = functionArn
          },
        )
      }
    }

    val updatedBehaviors = config.cacheBehaviors?.items?.map {
      if (it.pathPattern == pathPattern) {
        logger.info { "Updating existing behavior for $pathPattern" }
        newBehavior
      } else {
        it
      }
    }?.toMutableList() ?: mutableListOf(newBehavior)

    // If not updated, add it
    if (updatedBehaviors.none { it.pathPattern == pathPattern }) {
      logger.info { "Adding new behavior for $pathPattern" }
      updatedBehaviors.add(newBehavior)
    } else {
      logger.info { "Behavior for $pathPattern already updated" }
    }

    val newConfig = config.copy {
      origins = newOrigins
      cacheBehaviors {
        quantity = updatedBehaviors.size
        items = updatedBehaviors
      }
    }

    clClient.updateDistribution {
      id = distributionId
      ifMatch = etag
      distributionConfig = newConfig
    }
  }

3. Run the code and notice: You must specify IncludeCookies when Enabled is missing or set to true within a Logging object

Possible Solution

Unknown Yet. I tried setting the following config but it still produced the same issue:

      logging = config.logging?.copy {
        enabled = config.logging?.enabled ?: false
        includeCookies = config.logging?.includeCookies ?: false
        bucket = config.logging?.bucket ?: ""
        prefix = config.logging?.prefix ?: ""
      }

Context

No response

AWS SDK for Kotlin version

v1.4.92

Platform (JVM/JS/Native)

jvm

Operating system and version

Aws lambda 7 runtime

[ianbotsf]

Thanks for the detailed bug report @niqo01. Unfortunately this is a very complex API and it's difficult for me to see where the problem might be occurring, especially since you've already tried explicitly copying/setting the logging parameters. It might help to see a full copy of the request with actual values included. Can you enable request+body logging and post a copy of a failing request? (Feel free to redact anything sensitive.)

[alecmocatta]

maybe related:

• Avoid treating addedDefault as default when serializing numbers and bools smithy-lang/smithy-rs#4117

[niqo01]

@ianbotsf
No problem.

My log of the distributionConfig returned by the kotlin sdk getDistributionConfig shows:
logging=LoggingConfig(bucket=preprod-assetsstack-assetscdncdnlogbucket4bf60813-xmjmehqaosjt.s3.us-east-1.amazonaws.com,enabled=true,includeCookies=false,prefix=cdn-cloudfront/),

THe request:

<DistributionConfig
    xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
    <Aliases>
        <Items>
            <CNAME>*** Redacted ***</CNAME>
        </Items>
        <Quantity>1</Quantity>
    </Aliases>
    <CacheBehaviors>
        <Items>
            <CacheBehavior>
                <AllowedMethods>
                    <CachedMethods>
                        <Items>
                            <Method>GET</Method>
                            <Method>HEAD</Method>
                        </Items>
                        <Quantity>2</Quantity>
                    </CachedMethods>
                    <Items>
                        <Method>GET</Method>
                        <Method>HEAD</Method>
                    </Items>
                    <Quantity>2</Quantity>
                </AllowedMethods>
                <CachePolicyId>ServerlessImageHandler-4bb3177f-c35b-453c-b97a-4a7b7bb71f9f</CachePolicyId>
                <Compress>true</Compress>
                <FunctionAssociations>
                    <Items>
                        <FunctionAssociation>
                            <EventType>viewer-request</EventType>
                            <FunctionARN>arn:aws:cloudfront::480465344025:function/us-east-1Preprod-AssetsStoudFrontFunction07F6C3CB</FunctionARN>
                        </FunctionAssociation>
                    </Items>
                    <Quantity>1</Quantity>
                </FunctionAssociations>
                <OriginRequestPolicyId>ServerlessImageHandler-4bb3177f-c35b-453c-b97a-4a7b7bb71f9f</OriginRequestPolicyId>
                <PathPattern>/images/*</PathPattern>
                <TargetOriginId>custom-j3aoccw4z6-execute-api-us-east-1-amazonaws-com</TargetOriginId>
                <ViewerProtocolPolicy>redirect-to-https</ViewerProtocolPolicy>
            </CacheBehavior>
        </Items>
        <Quantity>1</Quantity>
    </CacheBehaviors>
    <CallerReference>412f72c2-860b-0501-df9b-79e77de4359d</CallerReference>
    <Comment>EnkiHangouts CDN for static and user-uploaded assets</Comment>
    <ContinuousDeploymentPolicyId></ContinuousDeploymentPolicyId>
    <CustomErrorResponses>
        <Items>
            <CustomErrorResponse>
                <ErrorCachingMinTTL>600</ErrorCachingMinTTL>
                <ErrorCode>500</ErrorCode>
                <ResponseCode></ResponseCode>
                <ResponsePagePath></ResponsePagePath>
            </CustomErrorResponse>
            <CustomErrorResponse>
                <ErrorCachingMinTTL>600</ErrorCachingMinTTL>
                <ErrorCode>501</ErrorCode>
                <ResponseCode></ResponseCode>
                <ResponsePagePath></ResponsePagePath>
            </CustomErrorResponse>
            <CustomErrorResponse>
                <ErrorCachingMinTTL>600</ErrorCachingMinTTL>
                <ErrorCode>502</ErrorCode>
                <ResponseCode></ResponseCode>
                <ResponsePagePath></ResponsePagePath>
            </CustomErrorResponse>
            <CustomErrorResponse>
                <ErrorCachingMinTTL>600</ErrorCachingMinTTL>
                <ErrorCode>503</ErrorCode>
                <ResponseCode></ResponseCode>
                <ResponsePagePath></ResponsePagePath>
            </CustomErrorResponse>
            <CustomErrorResponse>
                <ErrorCachingMinTTL>600</ErrorCachingMinTTL>
                <ErrorCode>504</ErrorCode>
                <ResponseCode></ResponseCode>
                <ResponsePagePath></ResponsePagePath>
            </CustomErrorResponse>
        </Items>
        <Quantity>5</Quantity>
    </CustomErrorResponses>
    <DefaultCacheBehavior>
        <AllowedMethods>
            <CachedMethods>
                <Items>
                    <Method>HEAD</Method>
                    <Method>GET</Method>
                </Items>
                <Quantity>2</Quantity>
            </CachedMethods>
            <Items>
                <Method>HEAD</Method>
                <Method>GET</Method>
            </Items>
            <Quantity>2</Quantity>
        </AllowedMethods>
        <CachePolicyId>658327ea-f89d-4fab-a63d-7e88639e58f6</CachePolicyId>
        <Compress>true</Compress>
        <FieldLevelEncryptionId></FieldLevelEncryptionId>
        <FunctionAssociations>
            <Quantity>0</Quantity>
        </FunctionAssociations>
        <GrpcConfig>
            <Enabled>false</Enabled>
        </GrpcConfig>
        <LambdaFunctionAssociations>
            <Quantity>0</Quantity>
        </LambdaFunctionAssociations>
        <ResponseHeadersPolicyId>7811f277-d591-4303-9f66-8b0c1456fe70</ResponseHeadersPolicyId>
        <SmoothStreaming>false</SmoothStreaming>
        <TargetOriginId>HangoutsPipelineStackPreprodAssetsStackAssetsCdnCdnDistributionOrigin1DD9CA7CF</TargetOriginId>
        <TrustedKeyGroups>
            <Enabled>false</Enabled>
            <Quantity>0</Quantity>
        </TrustedKeyGroups>
        <TrustedSigners>
            <Enabled>false</Enabled>
            <Quantity>0</Quantity>
        </TrustedSigners>
        <ViewerProtocolPolicy>https-only</ViewerProtocolPolicy>
    </DefaultCacheBehavior>
    <DefaultRootObject></DefaultRootObject>
    <Enabled>true</Enabled>
    <HttpVersion>http2</HttpVersion>
    <IsIPV6Enabled>true</IsIPV6Enabled>
    <Logging>
        <Bucket>preprod-assetsstack-assetscdncdnlogbucket4bf60813-xmjmehqaosjt.s3.us-east-1.amazonaws.com</Bucket>
        <Enabled>true</Enabled>
        <Prefix>cdn-cloudfront/</Prefix>
    </Logging>
    <OriginGroups>
        <Quantity>0</Quantity>
    </OriginGroups>
    <Origins>
        <Items>
            <Origin>
                <ConnectionAttempts>3</ConnectionAttempts>
                <ConnectionTimeout>10</ConnectionTimeout>
                <CustomHeaders>
                    <Quantity>0</Quantity>
                </CustomHeaders>
                <DomainName>preprod-assetsstack-staticassetsstoragemainbucket9-divrqqsxqsdo.s3.us-east-1.amazonaws.com</DomainName>
                <Id>HangoutsPipelineStackPreprodAssetsStackAssetsCdnCdnDistributionOrigin1DD9CA7CF</Id>
                <OriginAccessControlId>E1SZMD2B5HU761</OriginAccessControlId>
                <OriginPath></OriginPath>
                <OriginShield>
                    <Enabled>false</Enabled>
                </OriginShield>
                <S3OriginConfig>
                    <OriginAccessIdentity></OriginAccessIdentity>
                </S3OriginConfig>
            </Origin>
            <Origin>
                <CustomOriginConfig>
                    <HTTPPort>80</HTTPPort>
                    <HTTPSPort>443</HTTPSPort>
                    <OriginProtocolPolicy>https-only</OriginProtocolPolicy>
                    <OriginSslProtocols>
                        <Items>
                            <SslProtocol>TLSv1.2</SslProtocol>
                        </Items>
                        <Quantity>1</Quantity>
                    </OriginSslProtocols>
                </CustomOriginConfig>
                <DomainName>j3aoccw4z6.execute-api.us-east-1.amazonaws.com</DomainName>
                <Id>custom-j3aoccw4z6-execute-api-us-east-1-amazonaws-com</Id>
                <OriginPath>/image</OriginPath>
            </Origin>
        </Items>
        <Quantity>2</Quantity>
    </Origins>
    <PriceClass>PriceClass_100</PriceClass>
    <Restrictions>
        <GeoRestriction>
            <Quantity>0</Quantity>
            <RestrictionType>none</RestrictionType>
        </GeoRestriction>
    </Restrictions>
    <Staging>false</Staging>
    <ViewerCertificate>
        <ACMCertificateArn>arn:aws:acm:us-east-1:480465344025:certificate/9eca2f35-00a5-4359-9546-b5a40a359f9c</ACMCertificateArn>
        <Certificate>arn:aws:acm:us-east-1:480465344025:certificate/9eca2f35-00a5-4359-9546-b5a40a359f9c</Certificate>
        <CertificateSource>acm</CertificateSource>
        <CloudFrontDefaultCertificate>false</CloudFrontDefaultCertificate>
        <MinimumProtocolVersion>TLSv1.2_2021</MinimumProtocolVersion>
        <SSLSupportMethod>sni-only</SSLSupportMethod>
    </ViewerCertificate>
    <WebACLId>arn:aws:wafv2:us-east-1:480465344025:global/webacl/Enki-WebAcl/f9698c6f-1ac0-43a4-ac1b-1bb34f3b54a9</WebACLId>undefined
</DistributionConfig>

The response:

<ErrorResponse
    xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
    <Error>
        <Type>Sender</Type>
        <Code>IllegalUpdate</Code>
        <Message>You must specify IncludeCookies when Enabled is missing or set to true within a Logging object</Message>
    </Error>
    <RequestId>d1284f51-66c8-4f82-882c-c11ed4b6f7d3</RequestId>
</ErrorResponse>

My guess is that includeCookies is not serialized by the sdk.

[niqo01]

On my CDN config if I set includeCookies to true like:

        .enableLogging(true)
        .logBucket(logBucket)
        .logFilePrefix("cdn-cloudfront/")
        .logIncludesCookies(true) // fix behavior serialization

Then updating the behavior later works.
Meaning the issue comes from serializing false similar to what @alecmocatta describes.