title: CloudFront policy to invalidate only specific distrubution
body: <p>I'm using S3 bucket to store files and CloudFront to distribute them. I have a tool that handles synchronization automatically and it works great.</p>
  
  <p>However, I want to be able to also create CloudFront invalidations programmatically. What statement do I need to add to the tool's policy in order to allow creating invalidation only for this specific distribution?</p>
  
  <p>Right now, I have this statement:</p>
  
  <pre><code>{
      "Effect": "Allow",
      "Action": [
          "cloudfront:CreateInvalidation"
      ],
      "Resource": "*"
  }
  </code></pre>
  
  <p>But, as you can see, it allows to create invalidations for any distribution in account.</p>
  
  <p>I've tried to use these values for <code>Resource</code> property, but for some reason the tool gave me an error, saying that access is denied:</p>
  
  <ul>
  <li><code>arn:aws:cloudfront::12345678:distribution/ABCDEFG</code></li>
  <li><code>arn:aws:cloudfront:::distribution/ABCDEFG</code></li>
  </ul>
  
  <p><strong>What do I need to specify in <code>Resource</code> property in order to allow creation of invalidation only for the specific distribution?</strong></p>
  
  <p>It's ARN is <code>arn:aws:cloudfront::12345678:distribution/ABCDEFG</code> for example.</p>