CloudFront Origin Access Identity ARNs are incorrectly identified as UNKNOWN_PRINCIPAL

[seth-carroll]

When validating a bucket policy that contains a CloudFront OAI ARN, this ARN is incorrectly being flagged as an unknown principal. For example, this policy fails validation:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Principal": { "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity 00000000000000" },
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::examplebucket/*"]
    }
  ]
}