(cloudfront): explicit OAI for S3Origin doesn't work for cloudfront.

[DarshanAwachat]

General Issue

General Issue

The Question

When I try to associate OAI by passing the props in the S3Origin, it doesn't work
const s3Origin = new S3Origin(Bucket, {originAccessIdentity: oai});
While it works when no OAI is passed, A new OAI is created for the same bucket
const s3Origin = new S3Origin(Bucket)

I create the OAI by using cloudfront.OriginAccessIdentity

const oai = new cloudfront.OriginAccessIdentity(this, 'OAI',{
   comment: "This is for OAI"
})

CDK CLI Version

1.126.0

Framework Version

No response

Node.js Version

No response

OS

Windows

Language

Typescript

Language Version

No response

Other information

No response

[smguggen]

@DarshanAwachat Could you give some more detail? I tried to reproduce this and it worked for me.

[DarshanAwachat]

I am doing a migration from cloudfrontWebDistribution to Distribution Api. Actually, I should have been more clear OAI is associated but bucket policy is destroyed while the update. If you want more cod snippet it may take time. So, Actually it worked when I added this line bucket.grantRead(oai).

[smguggen]

Ah, no need, that explains it. The issue is here:

 public bind(scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
    if (!this.originAccessIdentity) {
      // Using a bucket from another stack creates a cyclic reference with
      // the bucket taking a dependency on the generated S3CanonicalUserId for the grant principal,
      // and the distribution having a dependency on the bucket's domain name.
      // Fix this by parenting the OAI in the bucket's stack when cross-stack usage is detected.
      const bucketStack = cdk.Stack.of(this.bucket);
      const bucketInDifferentStack = bucketStack !== cdk.Stack.of(scope);
      const oaiScope = bucketInDifferentStack ? bucketStack : scope;
      const oaiId = bucketInDifferentStack ? `${cdk.Names.uniqueId(scope)}S3Origin` : 'S3Origin';

      this.originAccessIdentity = new cloudfront.OriginAccessIdentity(oaiScope, oaiId, {
        comment: `Identity for ${options.originId}`,
      });

      // Used rather than `grantRead` because `grantRead` will grant overly-permissive policies.
      // Only GetObject is needed to retrieve objects for the distribution.
      // This also excludes KMS permissions; currently, OAI only supports SSE-S3 for buckets.
      // Source: https://aws.amazon.com/blogs/networking-and-content-delivery/serving-sse-kms-encrypted-content-from-s3-using-cloudfront/
      this.bucket.addToResourcePolicy(new iam.PolicyStatement({
        resources: [this.bucket.arnForObjects('*')],
        actions: ['s3:GetObject'],
        principals: [this.originAccessIdentity.grantPrincipal],
      }));
    }
    return super.bind(scope, options);
  }

The OAI being added to the bucket policy is inside the if (!this.originAccessIdentity) closure, so adding a custom OAI means that that conditional returns false and the policy isn't added to the bucket. Also note the comment in there that using grantRead adds overly permissive policies, so there's an extra advantage to fixing this. I've submitted a pull request to fix this issue, but in the meantime explicitly granting the read like you did should fix the issue.

[peterwoodworth]

Thanks for taking a look at this and submitting a PR already @smguggen, it's much appreciated 🙂

Will take a look at PR soon