https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.CfnDistribution.OriginShieldProperty.html

I am trying to add OriginShielding to a Cloudfront Distribution via CDK and the docs are very unclear about the approach.

To access origin shield within CDK you have to call cfnDistribution, however that doesn't appear to be compatible with the cloudfront distribution construct, nor cloudfront-origins.

Do I need to use cfnDistribution for the whole distribution?

It would be very helpful to have more thorough examples of a Cloudfront Distribution setup, especially after deprecating CloudFrontWebDistribution.