AWS CDKのクロススタック構成でCloudFront OACのバケットポリシーが自動設定できない問題と回避策

// ✅ 同一スタック内なら自動設定が機能する
const bucket = new s3.Bucket(this, 'MyBucket', {
  // ... 設定
});

const distribution = new cloudfront.Distribution(this, 'MyDistribution', {
  defaultBehavior: {
    origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
    // ... その他の設定
  },
});

{
  "Effect": "Allow",
  "Principal": {
    "Service": "cloudfront.amazonaws.com"
  },
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": {
    "StringEquals": {
      "AWS:SourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
    }
  }
}

// CloudFrontStack
const bucket = s3.Bucket.fromBucketAttributes(this, 'ImportedBucket', {
  bucketName: props.bucketName,
  region: props.bucketRegion, // ← 明示的なリージョン指定が必要
});

const distribution = new cloudfront.Distribution(this, 'MyDistribution', {
  defaultBehavior: {
    origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
    // ... その他の設定
  },
});

[WARNING] @aws-cdk/aws-cloudfront-origins:updateImportedBucketPolicyOac

// StorageStack
export class StorageStack extends cdk.Stack {
  public readonly bucket: s3.IBucket;

  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    this.bucket = new s3.Bucket(this, 'MyBucket', {
      versioned: true,
      encryption: s3.BucketEncryption.S3_MANAGED,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      // ... その他の設定
    });

    // CloudFront OACからのアクセスを手動で事前に許可
    this.bucket.addToResourcePolicy(
      new cdk.aws_iam.PolicyStatement({
        sid: 'AllowCloudFrontServicePrincipal',
        effect: cdk.aws_iam.Effect.ALLOW,
        principals: [new cdk.aws_iam.ServicePrincipal('cloudfront.amazonaws.com')],
        actions: ['s3:GetObject'],
        resources: [this.bucket.arnForObjects('*')],
        conditions: {
          StringEquals: {
            'AWS:SourceAccount': cdk.Stack.of(this).account,
          },
        },
      })
    );
  }
}

// CloudFrontStack
export class CloudFrontStack extends cdk.Stack {
  public readonly distribution: cloudfront.Distribution;

  constructor(scope: Construct, id: string, props: CloudFrontStackProps) {
    super(scope, id, props);

    // S3バケットをリージョン情報付きで参照
    const bucket = s3.Bucket.fromBucketAttributes(this, 'ImportedBucket', {
      bucketName: props.bucketName,
      region: props.bucketRegion, // ← これがないとPermanentRedirectエラー
    });

    // Origin Access Control（OAC）の作成
    const oac = new cloudfront.S3OriginAccessControl(this, 'OAC', {
      signing: cloudfront.Signing.SIGV4_NO_OVERRIDE,
    });

    // CloudFront Distributionの作成
    this.distribution = new cloudfront.Distribution(this, 'ReportDistribution', {
      defaultBehavior: {
        origin: origins.S3BucketOrigin.withOriginAccessControl(bucket, {
          originAccessControl: oac,
        }),
        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        // ... その他の設定
      },
    });

    // 警告を抑制（バケットポリシーはStorageStackで手動設定済み）
    cdk.Annotations.of(this.distribution).acknowledgeWarning(
      '@aws-cdk/aws-cloudfront-origins:updateImportedBucketPolicyOac'
    );
  }
}

// bin/app.ts
const storageStack = new StorageStack(app, 'MyApp-Storage', {
  env: { region: 'ap-northeast-1' },
  crossRegionReferences: true,
});

const cloudFrontStack = new CloudFrontStack(app, 'MyApp-CloudFront', {
  env: { region: 'us-east-1' },
  crossRegionReferences: true,
  bucketName: storageStack.bucket.bucketName,
  bucketRegion: 'ap-northeast-1',
});

{
  "Condition": {
    "StringEquals": {
      "AWS:SourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
    }
  }
}

{
  "Condition": {
    "StringEquals": {
      "AWS:SourceAccount": "123456789012"
    }
  }
}