aws-cloudfront-origins: optional s3:PutObject permission missing in S3BucketOrigin.withOriginAccessControl

[garysassano]

Describe the bug

According to the AWS docs, it's possible to grant both read and write access when using CloudFront OAC with an S3 bucket origin. However, the S3BucketOrigin.withOriginAccessControl L2 construct currently defaults to read-only access, and there is no built-in option to add write permissions.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

See above.

Current Behavior

See above.

Reproduction Steps

See above.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.156.0

Framework Version

No response

Node.js Version

20.17.0

OS

Ubuntu 22.04.3 LTS

Language

TypeScript

Language Version

No response

Other information

No response

[vpylypenko2]

Try to set originAccessLevels to [cloudfront.AccessLevel.READ, cloudfront.AccessLevel.WRITE]

import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';

const accessControl = new cloudfront.S3OriginAccessControl(this, 'AccessControl', {
  originAccessControlName: <name>,
  description: <description>
});

origins.S3BucketOrigin.withOriginAccessControl(
  <bucket>, {
    originAccessControl: accessControl,
    originAccessLevels: [cloudfront.AccessLevel.READ, cloudfront.AccessLevel.WRITE]}
)

[garysassano]

Thanks, that seems to work in adding the s3:PutObject permission to the S3 bucket policy:

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.