const ret = new class extends BucketPolicy {
      public readonly document = PolicyDocument.fromJson(cfnBucketPolicy.policyDocument);
    }(cfnBucketPolicy, id, {
      bucket,
    });

    this.resource = new CfnBucketPolicy(this, 'Resource', {
      bucket: this.bucket.bucketName,
      policyDocument: this.document,
    });

import * as cdk from 'aws-cdk-lib';
import { PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
import { Bucket, BucketPolicy, CfnBucketPolicy } from 'aws-cdk-lib/aws-s3';
import { Construct } from 'constructs';
// import * as sqs from 'aws-cdk-lib/aws-sqs';

export class ReproStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const bucketName = "amzn-s3-demo-bucket";

    const bucket = new Bucket(this, "Bucket", {
      bucketName
    })

    const bucketPolicy = new CfnBucketPolicy(this, "BucketPolicy", {
      bucket: bucketName,
      policyDocument: {
        Statement: [
          {
            Action: 's3:*',
            Effect: 'Deny',
            Principal: {
              AWS: '*',
            },
            Resource: [
              `arn:aws:s3:::${bucketName}`,
              `arn:aws:s3:::${bucketName}/*`,
            ],
          },
        ],
        Version: '2012-10-17',
      },
    });

    BucketPolicy.fromCfnBucketPolicy(bucketPolicy);

    bucket.addToResourcePolicy(new PolicyStatement({
      actions: ["s3:ListObject"],
      principals: [new ServicePrincipal("cloudfront.amazonaws.com")]
    }))
  }
}