Describe the feature

Amazon CloudFront now supports Origin Access Control, an improved method for accessing S3 Origins over Origin Access Identity.

It seems that the CloudFormation documentation (and resource specification) has not yet been updated but the OAC docs contain an example of deploying using CloudFormation.

I am opening an issue to discuss this because the S3Origin class currently only supports OAI and creates one by default; migrating to do so would likely

Use Case

The release announcement and documentation describe OAC as an improvement over OAI. OAC supports requests other than GET as well as SSE-KMS, and all AWS regions. Documentation already refers to OAI as "legacy".

Proposed Solution

I propose doing all of the following:

• Implement a feature flag, @aws-cdk/aws-cloudfront:useOriginAccessControl. When this is true, by default an OAC will be used instead of an OAI.
• Create an L2 construct for an OriginAccessControl; use an enum for SigningBehavior and SigningType. Maybe for OriginAccessControlOriginType too.
• Add an originAccessControl prop to S3OriginProps of type cloudfront.IOriginAccessControl. When truthy, this is used and an OAI is not created. When not specified, an OAI is created and used
• Have S3Origin add the necessary statements to the S3 bucket resource policy

Feature flag behavior

To migrate, a user would enable the feature flag. If they were already passing an OAI, they'd run with both side-by-side (a supported configuration), if not they'd use only an OAC. To migrate to OAC-only, they can then use a custom-created OAC or the default one.

Other Information

The CreateOriginAccessControl action seems like it's pretty likely to map 1:1 to the CloudFormation resource https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateOriginAccessControl.html. The example in the docs is:

Type: AWS::CloudFront::OriginAccessControl
Properties: 
  OriginAccessControlConfig: 
      Description: An optional description for the origin access control
      DisplayName: ExampleOAC
      OriginType: s3
      SigningBehavior: always
      SigningProtocol: sigv4

Implementation requires a new CloudFormation Resource Specification but since an example is given in the CloudFront docs, hopefully that won't take and since this may require other changes, having a conversation may be helpful.

This felt smaller than an RFC but I'm happy to open one if needed.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.39.0

Environment details (OS name and version, etc.)