OAIからOACに変更してオリジンのS3バケットをKMSで暗号化してみた

import {
  Stack,
  StackProps,
  aws_s3,
  aws_cloudfront,
  aws_cloudfront_origins,
  aws_s3_deployment,
  aws_iam,
  RemovalPolicy,
  Duration,
} from 'aws-cdk-lib';

import { Construct } from 'constructs';
export class S3HostingPracticeStack extends Stack {
  constructor(
    scope: Construct,
    id: string,
    props: StackProps,
  ) {
    super(scope, id, props);

    //オリジンに指定するS3バケット作成
    const hostingBucket = new aws_s3.Bucket(
      this,
      `s3-hosting-bucket`,
      {
        bucketName: `s3-hosting-bucket-${Stack.of(this).account}`,
        removalPolicy: RemovalPolicy.DESTROY,
        encryption: aws_s3.BucketEncryption.S3_MANAGED,
        blockPublicAccess: aws_s3.BlockPublicAccess.BLOCK_ALL, // オリジンへのアクセスをCloudFrontに限定するためにBLOCK_ALL設定
      },
    );

    //OAI作成
    const oai = new aws_cloudfront.OriginAccessIdentity(this, 'OAI', {
      comment: 'OAI',
    });

    //OAIにGetObjectを許可するバケットポリシーを作成しバケットに付与
    const policyGetObjectForOAI = new aws_iam.PolicyStatement({
      sid:"AllowOAIGetObject",
      effect: aws_iam.Effect.ALLOW,
      actions: ['s3:GetObject'],
      principals: [
        new aws_iam.CanonicalUserPrincipal(
          oai.cloudFrontOriginAccessIdentityS3CanonicalUserId,
        ),
      ],
      resources: [`${hostingBucket.bucketArn}/*`],//s3:GetObjectはオブジェクトへの操作なので`/*`を付ける
    });
    hostingBucket.addToResourcePolicy(policyGetObjectForOAI);

    //Distributionの作成
    const websiteDistribution = new aws_cloudfront.Distribution(
      this,
      'CloudFrontDistribution',
      {
        comment: 'website-distribution',
        defaultRootObject: 'index.html',
        defaultBehavior: {
          allowedMethods: aws_cloudfront.AllowedMethods.ALLOW_GET_HEAD,
          cachedMethods: aws_cloudfront.CachedMethods.CACHE_GET_HEAD,
          cachePolicy: aws_cloudfront.CachePolicy.CACHING_OPTIMIZED,
          viewerProtocolPolicy:
            aws_cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          origin: new aws_cloudfront_origins.S3Origin(hostingBucket, {
            originAccessIdentity: oai,
          }),
        },
        errorResponses: [
          {
            ttl: Duration.seconds(300),
            httpStatus: 403, //forbidden
            responseHttpStatus: 403,
            responsePagePath: '/index.html',
          },
          {
            ttl: Duration.seconds(300),
            httpStatus: 404, //not found
            responseHttpStatus: 404,
            responsePagePath: '/index.html',
          },
        ],
      },
    );
    //S3バケットにデプロイするコンテンツの設定
    new aws_s3_deployment.BucketDeployment(this, 'webSiteDeploy', {
      destinationBucket: hostingBucket,
      sources: [
        aws_s3_deployment.Source.asset('./web-app'),
      ],
      distribution: websiteDistribution,
      distributionPaths: ['/*'],
    });
  }
}

//KMSキーの作成を追加
const kmsKey = new aws_kms.Key(
  this,"kms managed key", {
    description:"kms managed key",
    removalPolicy:RemovalPolicy.DESTROY
  }
)

//S3バケットの作成部分の暗号化の指定を修正
const hostingBucket = new aws_s3.Bucket(
  this,
  `s3-hosting-bucket`,
  {
    bucketName: `s3-hosting-bucket-${Stack.of(this).account}`,
    removalPolicy: RemovalPolicy.DESTROY,
    encryptionKey:kmsKey, // 上記作成したKMSキーを指定
    encryption: aws_s3.BucketEncryption.KMS, //バケットの暗号化をKMSに指定
    blockPublicAccess: aws_s3.BlockPublicAccess.BLOCK_ALL,
  },
);

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOAIGetObject",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E19UFSHZRALVTS"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::s3-hosting-bucket-************/*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "AllowOACGetObject",
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"      // 変更点
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::s3-hosting-bucket-************/*",
        "Condition": {                                 // 変更点
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront::<AWS アカウント ID>:distribution/<CloudFront distribution ID>"
            }
        }
    }
}

{
    "Effect": "Allow",
    "Principal": {
        "Service": "cloudfront.amazonaws.com"
    },
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudfront::<AWS アカウント ID>:distribution/<CloudFront distribution ID>""
        }
    }
}