(cloudfront.distribution): (No way to set the Origin access to Origin access control settings (recommended))

[aramatev]

Describe the feature

in python aws cdk, there is no way to create Origin access control setting, which is the recommended way. Furthermore when you go to create Distribution there is no way to set the origin access to AOC, the only IOrigin I see is AOI, which also does not work cloudfront.OriginAccessIdentity(). So currently there is no way to make Cloudfront to s3 website work without getting 403 forbidden error.

See, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-oac-permission-to-access-s3

You can use the legacy way the cloudfront.CloudFrontWebDistribution() way, but it is deprecated and we're told to use Distribution. So please make it work.

Use Case

It seems like we're missing a recommended way to set S3 origin source in cloudfront distribution.

Proposed Solution

I think this is simply not coded and needs to be

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

aws-cdk-lib==2.99.1

Environment details (OS name and version, etc.)

macos, node v20.8.0, python 3.9.13

[pahud]

I guess this is related to #21771 ?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.