Unable to add WebACL to cloudfront distribution

[varkey98]

Getting com.amazonaws.services.cloudfront.model.InvalidWebACLIdException: Unable to verify read permissions on Web ACL. Please retry the request. error

Java: openjdk version "11.0.11" 2021-04-20 OpenJDK Runtime Environment AdoptOpenJDK-11.0.11+9 (build 11.0.11+9) OpenJDK 64-Bit Server VM AdoptOpenJDK-11.0.11+9 (build 11.0.11+9, mixed mode)
AWS SDK: 1.12.375
OS: Mac OS 13.0.1

[debora-ito]

Hi @varkey98 unfortunately there's not enough information here for me to help you properly.

Can you please provide:

• a sample code I can use to reproduce the error
• the full stacktrace of the error
• the version of the SDK you are using (e.g. 1.11.263)
• the JDK version you are using (e.g. Java 11, Java 17, etc)

[debora-ito]

From the CloudFront API Reference -
https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html#API_UpdateDistribution_Errors

---

InvalidWebACLId
A web ACL ID specified is not valid. To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example 473e64fd-f30b-4765-81a0-62ad96dd167a.

HTTP Status Code: 400

---

Please double check if the web ACL ID specified is valid.

[varkey98]

yeah, I specified the correct arn. What is this: Unable to verify read permissions on Web ACL. Please retry the request. referring to?

[toneyparky]

Hi there. I'm in the same situation, and I've also confirmed that the correct form of ARN is being used.
By any chance, should I go through cloudfront:CreateDistribution and implicitly include the permissions for the WAF below?

"wafv2:GetWebACL",
"wafv2:GetWebACLForResource",
"wafv2:AssociateWebACL"

I'll wait for your reply. Thanks :)

[toneyparky]

I added above policy to my IAM role, and the exception is gone. I guessed this solution from the exception message Unable to verify read permissions on Web ACL. Hope this help you :)