可以通过向AWS CDK堆栈添加以下代码来解决此问题：

import * as cloudfront from '@aws-cdk/aws-cloudfront';
import * as s3 from '@aws-cdk/aws-s3';

// 创建S3 Bucket
const bucket = new s3.Bucket(this, 'MyBucket');

// 创建CloudFront分发
const distribution = new cloudfront.CloudFrontWebDistribution(this, 'MyDistribution', {
  originConfigs: [
    {
      s3OriginSource: {
        s3BucketSource: bucket,
        originAccessIdentity: new cloudfront.OriginAccessIdentity(this, 'MyOAI'),
      },
      behaviors: [
        {
          isDefaultBehavior: true,
        }
      ]
    }
  ]
});

// 允许Origin Access Identity访问Bucket对象
bucket.addToResourcePolicy(new iam.PolicyStatement({
  actions: ['s3:GetObject'],
  principals: [
    distribution.originAccessIdentity.grantPrincipal
  ],
  resources: [bucket.arnForObjects('*')],
}));

这段代码创建了一个S3 Bucket和一个CloudFront分发。使用Origin Access Identity（OAI），它将从Bucket中获取对象并授予OAI访问这些对象的权限。最后，使用addToResourcePolicy方法将S3 Bucket与OAI相关联并添加访问策略。