CloudFrontToS3: Fails to get OAC Id

[lucas-subli]

Trying to use the CloudFrontToS3 construct always gives an error:

Unable to retrieve Id attribute for AWS::CloudFront::OriginAccessControl, with error message Access denied for operation 'AWS::CloudFront::OriginAccessControl'.

Reproduction Steps

const cf = new CloudFrontToS3(construct, 'portal-distribution', {
		bucketProps: {
			bucketName: 'web-distribution-bucket',
		},
		logS3AccessLogs: false,
		cloudFrontDistributionProps: {
			errorResponses: [
				{
					ttl: cdk.Duration.days(180),
					httpStatus: 403,
					responseHttpStatus: 200,
					responsePagePath: '/index.html',
				},
				{
					ttl: cdk.Duration.days(180),
					httpStatus: 404,
					responseHttpStatus: 200,
					responsePagePath: '/index.html',
				},
			],
		},
		logCloudFrontAccessLog: false,
	});

Error Log

CREATE_FAILED        | AWS::CloudFront::Distribution          | portal-distribution/CloudFrontDistribution (portaldistributionCloudFrontDistribution739C662C) Unable to retrieve Id attribute for AWS::CloudFront::OriginAccessControl, with error message Access denied for operation 'AWS::CloudFront::OriginAccessControl'.

Environment

• CDK CLI Version : "aws-cdk": "^2.177.0",
• AWS Solutions Constructs Version : "@aws-solutions-constructs/aws-cloudfront-s3": "^2.77.0"
• OS : Ubuntu 24.04
• Language : TS

Other

Relevant IAM permissons on the CDK execution role:

"cloudfront:CreateOriginAccessControl",
"cloudfront:UpdateOriginAccessControl",
"cloudfront:DeleteOriginAccessControl",
"cloudfront:GetOriginAccessControl",
"cloudfront:ListOriginAccessControls",
"cloudfront:GetOriginAccessControlConfig",

---

This is 🐛 Bug Report

[biffgaut]

Thanks, we'll check this out

[lucas-subli]

Adding

- cloudfront:DescribeFunction
- cloudfront:CreateFunction
- cloudfront:GetFunction
- cloudfront:PublishFunction

To the role seems to have fixed the issue, not sure why
And usually arn errors are formatted a little bit differently than this, but it seems to be working now.

Closing.

[biffgaut]

Thanks for letting us know - I figured it was a permissions issue and was paring down my privileges until I figured out which one. Apparently you have found it.