(cloudfront.Distribution): (default_behavior does nothing with origin_access_identity set to oai)

[aramatev]

Describe the bug

Not only does it not set the legacy setting using OAI, but there is no way to use the new OAC method. Specifically it does not work in python cdk, may be it works in typescript.

You can do the legacy Origin access using CloudFrontWebDistribution (but we're told this is deprecated and to use cloudfront.Distribution), so thats fine, but that still does not mean allow the API to take OAI and do nothing.
Also there is no way to set it to OAC which is the recommended method.
See this page about OAI vs OAC, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-oac-permission-to-access-s3.

this code block does not work, does not set the origin identity

# Create an OAI (Origin Access Identity)
oai = cloudfront.OriginAccessIdentity(self, "OAI")

# # Setup CloudFront distribution
        distribution = cloudfront.Distribution(self, "WebsiteDistribution",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(bucket, origin_access_identity=oai),
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
            ),
            domain_names=[self.domain_name, "www." + self.domain_name],
            certificate=self.certificate,

As for OAC, there is no documentation how to even do that with CloudFront distribution, I guess this I can post in a feature request issue.

Expected Behavior

Expected behavior is to have Legacy access set to the origin OAI you just created,

Current Behavior

Current behavior is to set nothing, and thus the distribution doesnt link to your S3.

Reproduction Steps

I already provided the code in the description to reproduce.
But you also need an s3 bucket,

bucket = s3.Bucket(self, "MyBucket",
                           bucket_name=self.resource_name('s3'),
                           website_index_document=self.index_page
                           )
        s3_deployment = s3deploy.BucketDeployment(self, 'DeployWebsite',
            sources=[s3deploy.Source.asset('./homepage')],
            destination_bucket=bucket
        )

Possible Solution

I'm not sure whats broken but i see online documentation for typescript, https://aws-cdk.com/deploying-a-static-website-using-s3-and-cloudfront, but somehow it does not work to do it in python.

Additional Information/Context

No response

CDK CLI Version

aws-cdk-lib==2.99.1

Framework Version

python

Node.js Version

v20.8.0

OS

mac os

Language

Python

Language Version

Python 3.9.13

Other information

No response

[shorn]

OAI will only work if you "remove the website configuration from the bucket": #22451 (comment)
I use TypeScript, but I had the same issue until I removed the website config from the bucket, then it worked.

OAC support has an open issue, but it looks like it's gotten derailed: #21771

[pahud]

@shorn thank you for chiming in.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.