Description
Have a question? Please checkout our Slack Community or visit our Slack Archive.
Describe the Feature
Add the capability of enabling origin access control as described in https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-cloudfront-introduces-origin-access-control-oac/, https://aws.amazon.com/about-aws/whats-new/2022/08/amazon-cloudfront-origin-access-control/, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html and https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control.
Expected Behavior
Origin access control is used between Cloudfront and the S3 origin instead of origin access identity. This
Use Case
Allows the use of SSE aws:kms and customer-managed KMS keys that can be shared across accounts that, in turn, allows for cross-account deployments with KMS-encrypted S3 buckets.
Describe Ideal Solution
The S3 bucket that is configured as S3 origin has the proper policy assigned to allow Cloudfront to access it via OAC instead of OAI.
Alternatives Considered
None.
Additional Context
Once I used your module to create a Cloudfront distribution with OAI, I then followed the instructions in the Cloudfront developer guide to update the distribution with the OAC I created using Terraform cloudfront_origin_access_control.
cloudfront get-distribution-config --id dist-id --output yaml > dist-config.yaml
Edit as specified in https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html section labeled To attach an OAC to an S3 bucket origin in an existing distribution (CLI with input file)
cloudfront update-distribution --id dist-id --cli-input-yaml file://dist-config.yaml