(aws-cloudfront): deprecated property prevents CDKv2 users from using trusted signers

[kfritz]

Describe the feature

AWS CloudFront provides two mechanisms for restricting access with signed requests: key groups and AWS accounts. The CloudFront developer guide clearly recommends using key groups, as there are numerous advantages to doing so. That said, CloudFront continues to support signing by AWS accounts.

PR #12847 added support for CloudFront's preferred trusted key group mechanism to the CDK Construct Library. As part of this PR, a @deprecated annotation was added to the trustedSigners property with a message to discourage its use. As part of the CDKv2 launch, all @deprecated properties are being excluded, leaving no path for users of CDKv2 to use AWS accounts as trusted signers without escape hatches.

I propose removing the @deprecated annotation from the trustedSigners property. Instead, we can replace it with a code comment that merely dissuades its usage. This will restore it to CDKv2 and allow consumers to use this feature if they still need to, at least until CloudFront decides to officially end support for it.

Use Case

As a developer who maintains a CloudFront distribution in CDK, I am blocked from upgrading to CDKv2 because my distribution is secured using AWS account trusted signers. Though trusted key pairs are preferred, I cannot immediately transition to using them because the AWS account that signs URLs to my website is owned by another entity.

Proposed Solution

I propose replacing line 377 of web-distribution.ts. Instead of using an @deprecated annotation, we can simply use a code comment to discourage use of this property. If something like a @discouraged annotation existed, that would be preferable; however, I am not aware of anything like that in the CDK repository.

This will not result in a breaking change to CDKv2. Rather, it would be strictly additive.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.20.0

Environment details (OS name and version, etc.)

Amazon Linux 2

[vgonzalo]

Just to add to this discussion: KeyGroups require the public key in the CloudFront distribution's account, but this is a problem when the keys are managed by a central account (a common use case in large organizations) and they are periodically rotated, if a rotation happens then the distribution's account will need to create a new KeyGroup for the new public key and assign it to the distribution, which is a process hard to automate with a high risk of downtime. Also KeyGroups can't be shared because they don't have ARN.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.