title: Change the order of a Terraform destroy -Can't destroy a CloudFront OAI :the CF distribution hasn't switched to a new OAI before the orig is destroyed
body: <p>In Terraform I have created a new project that creates a CloudFront Origin Access Identity. Let's call the the replacement OAI.</p>
  <p>I have an existing Terraform project that has been run in the past that had created an original Origin Access Identity. This project also created the CloudFront distribution - Lets call this the original OAI and the original project.</p>
  <p>I update the terraform in the original project to now have the CloudFront distribution use the replacement OAI (already created in the other replacement OAI project) and I commented out the code that created the original OAI project.</p>
  <p>The issue I have now is that after I run a Terraform apply on the original project with the changes, the Terraform is trying to delete the original OAI before the cloudfront distribution has switched over to use the replacement OAI in the new code changes.</p>
  <p>Here is the output of the Terraform apply with the destroy error</p>
  <pre><code>aws_cloudfront_origin_access_identity.main: Destroying... [id=E2ZPPB4JPINCIR]
  aws_s3_bucket_policy.blog: Modifying... [id=99999blog.example.org]
  aws_cloudfront_distribution.blog: Modifying... [id=E348CKFTF7SNVV]
  aws_s3_bucket_policy.blog: Modifications complete after 1s [id=99999blog.example.org]
  aws_cloudfront_distribution.blog: Still modifying... [id=E348CKFTF7SNVV, 10s elapsed]
  aws_cloudfront_distribution.blog: Still modifying... [id=E348CKFTF7SNVV, 20s elapsed]
  aws_cloudfront_distribution.blog: Still modifying... [id=E348CKFTF7SNVV, 3m10s elapsed]
  aws_cloudfront_distribution.blog: Modifications complete after 3m13s [id=E348CKFTF7SNVV]
  
  Error: CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.
          status code: 409, request id: f6401cd3-baf4-4ba6-9027-6350521f80f2
  </code></pre>
  <p>If I run the destroy again it will work and destroy it but I can not rely on manually running destroy again since this is running it a GitLab pipeline - The destroy has to work on its first run.</p>
  <p>To sum it up - I need the <code>aws_cloudfront_origin_access_identity.main: Destroying...</code> to happen after the <code>aws_cloudfront_distribution.blog: Modifications complete</code>, not before.</p>
  <p>How can I change this order? I played with depends on but can not get it to work. Is there something else I can try? Is there a sleep before destroy that I could add?</p>
  <p>Here is the Terraform file with the code commented out that was used to create the original OAI. I now have it using a shell script with aws cli commnands to get the data needed to link up to the replacement OAI (get_oai_info.sh) . I commented out the &quot;aws_cloudfront_origin_access_identity&quot; resource so it would get destroyed.</p>
  <pre><code>## Original OAI creation ***THIS IS WHAT WAS JUST COMMENTED OUT 
  ##   AND I WANT DESTROYED LAST AFTER THE NEW APPLY IS RUN*****:
  # resource &quot;aws_cloudfront_origin_access_identity&quot; &quot;main&quot; {
  #   comment = &quot;Created for ${var.application} ${var.environment}&quot;
  
  #   provider = aws.cloudfront_account
  # }
  
  data &quot;external&quot; &quot;oai_id&quot; {
    program = [&quot;bash&quot;, &quot;${path.module}/get_oai_info.sh&quot;]
  
    query = {
      id_lookup = &quot;Id&quot;
      environment  = var.environment
      account_nbr  = var.account_number
    }
  }
  </code></pre>
  <p>Here is the coudfront.tf file. I have the original OAI reference commented out and have it use the new/replacement OAI:</p>
  <pre><code>resource &quot;aws_cloudfront_distribution&quot; &quot;blog&quot; {
    origin {
      domain_name = &quot;${aws_s3_bucket.blog.bucket_regional_domain_name}&quot;
      origin_id   = &quot;${local.s3_origin_id}&quot;
  
      s3_origin_config {
  
        #1 - To test delete:
        #origin_access_identity = &quot;${aws_cloudfront_origin_access_identity.main.cloudfront_access_identity_path}&quot;
  
        #2 - ORIG working  - to test replacemment:
        origin_access_identity = &quot;origin-access-identity/cloudfront/${data.external.oai-id.result[&quot;id&quot;]}&quot;
      }
    }
  </code></pre>