Q-Bits: Creating A CloudFront Distribution Using Amazon Q Developer

Great! I've successfully created a fresh CDK Python stack in your current directory. Here's what was done:

1. Created a new CDK Python project with cdk init app --language python
2. Set up a Python virtual environment with python3 -m venv .venv
3. Activated the virtual environment and installed dependencies with pip install -r requirements.txt

The project structure is now ready:

• app.py: The main entry point for your CDK application
• q_bits_cloudfront/q_bits_cloudfront_stack.py: Your main stack definition
• .venv/: Virtual environment for Python dependencies
• Various configuration files like cdk.json, requirements.txt, etc.

To start working with this stack, you can:

1. Modify the q_bits_cloudfront_stack.py file to define your CloudFront resources
2. Run cdk synth to generate CloudFormation templates
3. Run cdk deploy to deploy your stack to AWS

The virtual environment is already activated in your current session. For future sessions, remember to activate it with:
source .venv/bin/activate


from aws_cdk import (
    Stack,
    aws_cloudfront as cloudfront,
    aws_cloudfront_origins as origins,
    aws_s3 as s3,
)
from constructs import Construct

class QBitsCloudfrontStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # Create an S3 bucket as the origin
        bucket = s3.Bucket(self, "XXXXXXXXXXXXX")

        # Create CloudFront distribution
        distribution = cloudfront.Distribution(
            self, 
            "Distribution",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(bucket),
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED,
            ),
            default_root_object="index.html",
            enable_logging=True,
            http_version=cloudfront.HttpVersion.HTTP2,
            price_class=cloudfront.PriceClass.PRICE_CLASS_100  # Use only North America and Europe
        )


from aws_cdk import (
    Stack,
    aws_cloudfront as cloudfront,
    aws_cloudfront_origins as origins,
    aws_s3 as s3,
    aws_iam as iam,
    CfnOutput,
)
from constructs import Construct

class QBitsCloudfrontStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # Reference existing bucket
        existing_bucket = s3.Bucket.from_bucket_name(
            self, 
            "ExistingBucket",
            bucket_name="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        )

        # Create Origin Access Control
        oac = cloudfront.CfnOriginAccessControl(
            self,
            "MyOriginAccessControl",
            origin_access_control_config=cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
                name="MyOAC",
                origin_access_control_origin_type="s3",
                signing_behavior="always",
                signing_protocol="sigv4"
            )
        )

        # Create CloudFront distribution with existing bucket
        distribution = cloudfront.Distribution(
            self, 
            "Distribution",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3BucketOrigin(
                    existing_bucket,
                    origin_access_control_id=oac.attr_id,
                ),
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED,
            ),
            default_root_object="index.html",
            enable_logging=True,
            http_version=cloudfront.HttpVersion.HTTP2,
            price_class=cloudfront.PriceClass.PRICE_CLASS_100
        )

        # Output the distribution ID
        CfnOutput(
            self,
            "DistributionId",
            value=distribution.distribution_id,
            description="CloudFront Distribution ID"
        )


Great! I've successfully updated your S3 bucket policy to allow requests from the CloudFront distribution created in your stack. Here's what I did:

1. Identified your CloudFront distribution ID (XXXXXXXXXXXXXXXX) from the stack outputs
2. Created a bucket policy that:
   • Allows the CloudFront service principal to access your bucket
   • Restricts access to only your specific CloudFront distribution using the AWS:SourceArn condition
   • Grants the s3:GetObject permission needed for CloudFront to serve content

The policy I applied follows AWS best practices by:
• Using the service principal approach (recommended for CloudFront OAC)
• Including a condition to restrict access to only your specific distribution
• Limiting permissions to only what's needed (GetObject)

Your CloudFront distribution should now be able to access and serve content from your S3 bucket while maintaining security by preventing direct public access to your bucket objects.