Code changes to TF: https://github.com/hashicorp/terraform/compare/master...jwieringa:cf-allow-origin-caching-rules

cloudfront.tf

variable "s3_bucket_id" {
  default = "s3-assets"
}

variable "s3_origin_id" {
  default = "S3-assets"
}

resource "aws_cloudfront_distribution" "main" {
  enabled             = true
  comment             = "test"
  price_class         = "PriceClass_All"
  default_root_object = ""

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  origin {
    domain_name = "${var.s3_bucket_id}.s3.amazonaws.com"
    origin_id   = "${var.s3_origin_id}"
  }

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "${var.s3_origin_id}"
    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    # the default_ttl and max_ttl fields should be optional so that "User Origin Cache Headers Options" is used
    default_ttl            = 3600
    max_ttl                = 86400

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }
}

get-distro-config

$ aws cloudfront get-distribution-config --id E274165D8L59DN
{
    "ETag": "E2TF8JV1WDBC9W",
    "DistributionConfig": {
        "Comment": "test",
        "CacheBehaviors": {
            "Quantity": 0
        },
        "Logging": {
            "Bucket": "",
            "Prefix": "",
            "Enabled": false,
            "IncludeCookies": false
        },
        "WebACLId": "",
        "Origins": {
            "Items": [
                {
                    "OriginPath": "",
                    "S3OriginConfig": {
                        "OriginAccessIdentity": ""
                    },
                    "Id": "S3-od-assets",
                    "DomainName": "test.s3.amazonaws.com"
                }
            ],
            "Quantity": 1
        },
        "DefaultRootObject": "",
        "PriceClass": "PriceClass_All",
        "Enabled": true,
        "DefaultCacheBehavior": {
            "TrustedSigners": {
                "Enabled": false,
                "Quantity": 0
            },
            "TargetOriginId": "S3-od-assets",
            "ViewerProtocolPolicy": "allow-all",
            "ForwardedValues": {
                "Headers": {
                    "Quantity": 0
                },
                "Cookies": {
                    "Forward": "none"
                },
                "QueryString": false
            },
            "MaxTTL": 86400,
            "SmoothStreaming": false,
            "DefaultTTL": 3600,
            "AllowedMethods": {
                "Items": [
                    "HEAD",
                    "GET"
                ],
                "CachedMethods": {
                    "Items": [
                        "HEAD",
                        "GET"
                    ],
                    "Quantity": 2
                },
                "Quantity": 2
            },
            "MinTTL": 0,
            "Compress": false
        },
        "CallerReference": "2016-06-15T18:50:02.721461525-04:00",
        "ViewerCertificate": {
            "CloudFrontDefaultCertificate": true,
            "MinimumProtocolVersion": "SSLv3",
            "CertificateSource": "cloudfront"
        },
        "CustomErrorResponses": {
            "Quantity": 0
        },
        "Restrictions": {
            "GeoRestriction": {
                "RestrictionType": "none",
                "Quantity": 0
            }
        },
        "Aliases": {
            "Quantity": 0
        }
    }
}

plan_error.txt

$ ~/go_workspace/bin/terraform plan
There are warnings and/or errors related to your configuration. Please
fix these before continuing.

Errors:

  * provider.aws: Internal validation of the provider failed! This is always a bug
with the provider itself, and not a user issue. Please report
this bug:

aws_cloudfront_distribution: default_ttl: One of optional, required, or computed must be set
  * aws_cloudfront_distribution.main: "default_cache_behavior.0.default_ttl": this field cannot be set
  * aws_cloudfront_distribution.main: "default_cache_behavior.0.max_ttl": this field cannot be set

problem_being_solved.md

Desire: Set "Object Caching" to "Use Origin Cache Headers" on Cloudfront

Via the AWS API, my understanding is that this is achieved by setting min_ttl to 0. When min_ttl is set to zero, the required default_ttl and max_ttl fields are no longer required. If min_ttl is set to a value greater than 0 and max_ttl and/or default_ttl are not set, the API returns an error.

To the best of my knowledge, this isn't documented in the SDK docs. From AWS general docs, see "Important" field. http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesMinTTL