'DistributionConfig.Origins.0.OriginAccessControlId', Origin_access_control_origin_type = 's3', I've started poking at implementing this (based off the branch created by #22026) and the real pain is going to be from the fact that the principal of the OAC is the CloudFront service principal with a condition of _OAC', The CreateOriginAccessControl action seems like it's pretty likely to map 1:1 to the CloudFormation resource. To migrate to OAC-only, they can then use a custom-created OAC or the default one. If they were already passing an OAI, they'd run with both side-by-side (a supported configuration), if not they'd use only an OAC. To migrate, a user would enable the feature flag. The given OAC is used, no OAI is created or used The given OAI is used and an OAC is created and used Have S3Origin add the necessary statements to the S3 bucket resource policy.

When not specified, an OAI is created and used When truthy, this is used and an OAI is not created. Add an originAccessControl prop to S3OriginProps of type cloudfront.IOriginAccessControl.Maybe for OriginAccessControlOriginType too. Create an L2 construct for an OriginAccessControl use an enum for SigningBehavior and SigningType.Implement a feature flag, When this is true, by default an OAC will be used instead of an OAI.Documentation already refers to OAI as 'legacy'. OAC supports requests other than GET as well as SSE-KMS, and all AWS regions. If the origin response includes one or more of the headers that are added in a response headers policy, the policy can specify if CloudFront uses the header it received from the origin or overwrites that header with the. The release announcement and documentation describe OAC as an improvement over OAI. CloudFront modifies the headers in the responses that it serves from the cache and the ones that it forwards from the origin.

I am opening an issue to discuss this because the S3Origin class currently only supports OAI and creates one by default migrating to do so would likely Use Case htaccess file the following:

Access control allow origin cloudfront