fix(cloudfront-origins): policy not added for custom OAI

[smguggen]

Closes #18185: When creating an S3Origin without including an existing Origin Access Identity, an OriginAccessIdentity is created and added to the bucket's resource policy. However, since the adding to the resource policy is inside of the if (!this.originAccessIdentity)closure, custom OAI's are not added to the bucket policy by default. Since using bucket.grantRead creates an overly permissive policy (as noted in the source code comments), adding the OAI to the bucket policy by default for both cases would create a more consistent result.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[peterwoodworth]

The fix looks good to me @smguggen, but be sure to run the integration tests! 🙂

[smguggen]

@peterwoodworth Yeah I just came back and saw that. I've been wracking my brain trying to figure out why integ.s3-origin is still failing and I didn't even notice there's another integration test called integ.s3-origin-oai, which is actually the one that's failing. My mistake, will fix.

[peterwoodworth]

LGTM, will let @njlynch take a look before merge

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: ed858a3
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mnapoli]

Thank you! ❤️ That allowed some simplifications in our CDK constructs (getlift/lift#150)