title: error updating CloudFront Distribution (E32RNPFGEUHQ6J): InvalidWebACLId: Web ACL is not accessible by the requester
body: <p>I am using <code>terraform</code> to create a <code>web-acl</code> in <code>aws</code> and want to associate that <code>web-acl</code> with CloudFront distribution.</p>
  <p>So, here's how my code looks like:</p>
  <pre><code>provider &quot;aws&quot; {
    alias  = &quot;east1&quot;
    region = &quot;us-east-1&quot;
  }
  
  # -------------------------------------------
  # -------------------------------------------
  # Cloud Front
  module &quot;front_end_cloudfront&quot; {
    source = &quot;./modules/front-end/CF&quot;
  
    # CF_ALIASES = [&quot;terraformer-frontend.dev.effi.com.au&quot;]  
    CF_LAMBDA_ARN = module.frontend_lambda.cf_lambda_qualified_arn
    CF_BUCKET_DOMAIN_NAME = module.front_end_bucket.website_endpoint
    CF_BUCKET_ORIGIN_ID = module.front_end_bucket.website_domain
    CF_TAGS_LIST = { &quot;Name&quot; : &quot;terraformer-front-end-cloudfrontv2&quot; }
    CF_CERTFICATE_ARN = var.CLOUDFRONT_US_EAST_1_ACM_ARN
    # WEB_ACL = module.waf.web_acl_id
    WEB_ACL = module.waf_cf.web_acl_id
  
    depends_on = [module.waf_cf]
  }
  
  
  
  # -------------------------------------------
  # -------------------------------------------
  # WAF for CF
  module &quot;waf_cf&quot; {
    source = &quot;./modules/waf&quot;
  
    providers = {
      aws = aws.east1
    }  
  
    WAF_NAME  = &quot;terraform-web-acl-cf&quot;
    WAF_DESCRIPTION = &quot;terraform web acl-cf&quot;
    WAF_SCOPE = &quot;CLOUDFRONT&quot;
    WAF_RULE_NAME_1 = &quot;AWSManagedRulesCommonRuleSet&quot;
    WAF_RULE_NAME_2 = &quot;AWSManagedRulesAmazonIpReputationList&quot;
    WAF_RULE_NAME_3 = &quot;AWSManagedRulesLinuxRuleSet&quot;
    WAF_RULE_NAME_4 = &quot;AWSManagedRulesKnownBadInputsRuleSet&quot;
    WAF_VENDOR = &quot;AWS&quot;
    WAF_METRIC_1 = &quot;aws-waf-logs-terraformer-metric&quot;
    WAF_METRIC_2 = &quot;aws-waf-logs-terraformer-metric&quot;
    WAF_METRIC_3 = &quot;aws-waf-logs-terraformer-metric&quot;
    WAF_METRIC_4 = &quot;aws-waf-logs-terraformer-metric&quot;
    WAF_TAG_LIST = {
      &quot;Tag1&quot; : &quot;Name&quot;
      &quot;Tag2&quot; : &quot;terraformer-rule-cf&quot;
    }
    WAF_METRIC = &quot;aws-waf-logs-friendly-metric-name&quot;
    CLOUDWATCH_METRICS_ENABLED = false
    SAMPLE_REQUESTS_ENABLED = false
  }
  
  </code></pre>
  <p>These are <code>terraform</code> modules I have wrote, the specific <code>resource</code> files for above modules are below respectively.</p>
  <pre><code># CF
  resource &quot;aws_cloudfront_distribution&quot; &quot;aws_cloudfront_distribution&quot; {
    # aliases = var.CF_ALIASES
  
    default_cache_behavior {
      allowed_methods = [&quot;GET&quot;, &quot;HEAD&quot;]
      cached_methods  = [&quot;GET&quot;, &quot;HEAD&quot;]
      compress        = &quot;true&quot;
      default_ttl     = &quot;0&quot;
  
      forwarded_values {
        cookies {
          forward = &quot;none&quot;
        }
  
        query_string = &quot;false&quot;
      }
  
      lambda_function_association {
        event_type   = &quot;origin-response&quot;
        include_body = &quot;false&quot;
        lambda_arn   = var.CF_LAMBDA_ARN
      }
  
      max_ttl                = &quot;0&quot;
      min_ttl                = &quot;0&quot;
      smooth_streaming       = &quot;false&quot;
      target_origin_id       = var.CF_BUCKET_ORIGIN_ID
      viewer_protocol_policy = &quot;redirect-to-https&quot;
    }
  
    enabled         = &quot;true&quot;
    http_version    = &quot;http2&quot;
    is_ipv6_enabled = &quot;true&quot;
  
    origin {
      custom_origin_config {
        http_port                = &quot;80&quot;
        https_port               = &quot;443&quot;
        origin_keepalive_timeout = &quot;5&quot;
        origin_protocol_policy   = &quot;http-only&quot;
        origin_read_timeout      = &quot;30&quot;
        origin_ssl_protocols     = [&quot;TLSv1&quot;, &quot;TLSv1.1&quot;, &quot;TLSv1.2&quot;]
      }
  
      domain_name = var.CF_BUCKET_DOMAIN_NAME
      origin_id   = var.CF_BUCKET_ORIGIN_ID
    }
  
    price_class = &quot;PriceClass_All&quot;
  
    restrictions {
      geo_restriction {
        restriction_type = &quot;none&quot;
      }
    }
  
    retain_on_delete = &quot;false&quot;
  
    tags = var.CF_TAGS_LIST
  
    viewer_certificate {
      acm_certificate_arn            = var.CF_CERTFICATE_ARN
      cloudfront_default_certificate = &quot;false&quot;
      minimum_protocol_version       = &quot;TLSv1.2_2018&quot;
      ssl_support_method             = &quot;sni-only&quot;
    }
  
    web_acl_id = var.WEB_ACL
  }
  
  # WAF
  resource &quot;aws_wafv2_web_acl&quot; &quot;aws_wafv2_web_acl&quot; {
    name        = var.WAF_NAME
    description = var.WAF_DESCRIPTION
    scope       = var.WAF_SCOPE
  
    default_action {
      allow {}
    }
  
    rule {
      name     = var.WAF_RULE_NAME_1
      priority = 1
  
      override_action {
        count {}
      }
  
      statement {
        managed_rule_group_statement {
          name        = var.WAF_RULE_NAME_1
          vendor_name = var.WAF_VENDOR
  
          # excluded_rule {
          #   name = &quot;SizeRestrictions_QUERYSTRING&quot;
          # }
  
          # excluded_rule {
          #   name = &quot;NoUserAgent_HEADER&quot;
          # }
        }
      }
  
      visibility_config {
        cloudwatch_metrics_enabled = var.CLOUDWATCH_METRICS_ENABLED
        metric_name                = var.WAF_METRIC_1
        sampled_requests_enabled   = var.SAMPLE_REQUESTS_ENABLED
      }
    }
  
  
  
    rule {
      name     = var.WAF_RULE_NAME_2
      priority = 2
  
      override_action {
        count {}
      }
  
      statement {
        managed_rule_group_statement {
          name        = var.WAF_RULE_NAME_2
          vendor_name = var.WAF_VENDOR
        }
      }
  
      visibility_config {
        cloudwatch_metrics_enabled = var.CLOUDWATCH_METRICS_ENABLED
        metric_name                = var.WAF_METRIC_2
        sampled_requests_enabled   = var.SAMPLE_REQUESTS_ENABLED
      }
    }  
  
  
    rule {
      name     = var.WAF_RULE_NAME_3
      priority = 3
  
      override_action {
        count {}
      }
  
      statement {
        managed_rule_group_statement {
          name        = var.WAF_RULE_NAME_3
          vendor_name = var.WAF_VENDOR
        }
      }
  
      visibility_config {
        cloudwatch_metrics_enabled = var.CLOUDWATCH_METRICS_ENABLED
        metric_name                = var.WAF_METRIC_3
        sampled_requests_enabled   = var.SAMPLE_REQUESTS_ENABLED
      }
    } 
  
    rule {
      name     = var.WAF_RULE_NAME_4
      priority = 4
  
      override_action {
        count {}
      }
  
      statement {
        managed_rule_group_statement {
          name        = var.WAF_RULE_NAME_4
          vendor_name = var.WAF_VENDOR
        }
      }
  
      visibility_config {
        cloudwatch_metrics_enabled = var.CLOUDWATCH_METRICS_ENABLED
        metric_name                = var.WAF_METRIC_4
        sampled_requests_enabled   = var.SAMPLE_REQUESTS_ENABLED
      }
    } 
  
    tags = var.WAF_TAG_LIST
  
    visibility_config {
      cloudwatch_metrics_enabled = var.CLOUDWATCH_METRICS_ENABLED
      metric_name                = var.WAF_METRIC
      sampled_requests_enabled   = var.SAMPLE_REQUESTS_ENABLED
    }
  }
  </code></pre>
  <p>But I am getting the below error</p>
  <blockquote>
  <p>error updating CloudFront Distribution (E32RNPFGEUHQ6J): InvalidWebACLId: Web ACL is not accessible by the requester.</p>
  </blockquote>
  <p>Here the <code>cloudfront</code> is created in <code>ap-southeast-2</code> region and the <code>waf</code> is created in <code>us-east-1</code> region.</p>
  <p><strong>Can someone please help me on this?</strong></p>