Amazon CloudFront
API Reference (API Version 2019-03-26)

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.


Update an origin access identity.

Request Syntax

PUT /2019-03-26/origin-access-identity/cloudfront/Id/config HTTP/1.1 <?xml version="1.0" encoding="UTF-8"?> <CloudFrontOriginAccessIdentityConfig xmlns=""> <CallerReference>string</CallerReference> <Comment>string</Comment> </CloudFrontOriginAccessIdentityConfig>

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in XML format.


Root level tag for the CloudFrontOriginAccessIdentityConfig parameters.

Required: Yes


A unique value (for example, a date-time stamp) that ensures that the request can't be replayed.

If the value of CallerReference is new (regardless of the content of the CloudFrontOriginAccessIdentityConfig object), a new origin access identity is created.

If the CallerReference is a value already sent in a previous identity request, and the content of the CloudFrontOriginAccessIdentityConfig is identical to the original request (ignoring white space), the response includes the same information returned to the original request.

If the CallerReference is a value you already sent in a previous request to create an identity, but the content of the CloudFrontOriginAccessIdentityConfig is different from the original request, CloudFront returns a CloudFrontOriginAccessIdentityAlreadyExists error.

Type: String

Required: Yes


Any comments you want to include about the origin access identity.

Type: String

Required: Yes

Response Syntax

HTTP/1.1 200 <?xml version="1.0" encoding="UTF-8"?> <CloudFrontOriginAccessIdentity> <CloudFrontOriginAccessIdentityConfig> <CallerReference>string</CallerReference> <Comment>string</Comment> </CloudFrontOriginAccessIdentityConfig> <Id>string</Id> <S3CanonicalUserId>string</S3CanonicalUserId> </CloudFrontOriginAccessIdentity>

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in XML format by the service.


Root level tag for the CloudFrontOriginAccessIdentity parameters.

Required: Yes


The current configuration information for the identity.

Type: CloudFrontOriginAccessIdentityConfig object


The ID for the origin access identity, for example, E74FTE3AJFJ256A.

Type: String


The Amazon S3 canonical user ID for the origin access identity, used when giving the origin access identity read permission to an object in Amazon S3.

Type: String


For information about the errors that are common to all actions, see Common Errors.


Access denied.

HTTP Status Code: 403


Origin and CallerReference cannot be updated.

HTTP Status Code: 400


The value of Quantity and the size of Items don't match.

HTTP Status Code: 400


The argument is invalid.

HTTP Status Code: 400


The If-Match version is missing or not valid for the distribution.

HTTP Status Code: 400


This operation requires a body. Ensure that the body is present and the Content-Type header is set.

HTTP Status Code: 400


The specified origin access identity does not exist.

HTTP Status Code: 404


The precondition given in one or more of the request-header fields evaluated to false.

HTTP Status Code: 412

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: