Amazon CloudFront Origin Access Control L2 Construct

[gracelu0]

Description

CloudFront Origin Access Control (OAC) is the recommended way to send authenticated requests to an Amazon S3 origin using IAM service principals. It offers better security, supports server-side encryption with AWS KMS, and supports all Amazon S3 buckets in all AWS regions.

Currently the S3Origin construct automatically creates an Origin Access Identity (OAI) to restrict access to an S3 Origin. However, using OAI is now considered legacy and no longer recommended. CDK users who want to use OAC currently have to use the L1 construct CfnOriginAccessControl. They need to use escape hatches to attach the OAC to their CloudFront distribution and remove the OAI that is automatically configured. With a CloudFront OAC L2 construct, users will easily be able to set up their CloudFront origins using OAC instead of OAI.

Roles

Role	User
Author(s)	@gracelu0
API Bar Raiser	@comcalvi

See RFC Process for details

Workflow

• Tracking issue created (label: status/proposed)
• API bar raiser assigned (ping us at #aws-cdk-rfcs if needed)
• Kick off meeting
• RFC pull request submitted (label: status/review)
• Community reach out (via Slack and/or Twitter)
• API signed-off (label status/api-approved applied to pull request)
• Final comments period (label: status/final-comments-period)
• Approved and merged (label: status/approved)
• Execution plan submitted (label: status/planning)
• Plan approved and merged (label: status/implementing)
• Implementation complete (label: status/done)

---

Author is responsible to progress the RFC according to this checklist, and
apply the relevant labels to this issue so that the RFC table in README gets
updated.

[gotgenes]

This RFC discusses CloudFront OAC with S3, however, as mentioned by @antstanley in their comment on #491—which was closed in favor if this RFC—AWS has released OAC for other origins including AWS Lambda. Is support for those also tracked here, or are those covered in one or more separate RFCs and issues?

[gracelu0]

This RFC discusses CloudFront OAC with S3, however, as mentioned by @antstanley in their comment on #491—which was closed in favor if this RFC—AWS has released OAC for other origins including AWS Lambda. Is support for those also tracked here, or are those covered in one or more separate RFCs and issues?

As mentioned in the RFC this is scoped to OAC for S3 origins. While we can’t commit to specific dates, we’re planning to support OAC for Lambda function url origins in the future. We always welcome you to create a new issue/RFC to track feature requests so the community can upvote and help us prioritize accordingly!