fix(mediapackagev2): cdnAuth on OriginEndpoint now generates the required policy (#38013)

### Issue # (if applicable)

Closes #<issue number here>.

### Reason for this change



### Description of changes



Setting `cdnAuth` on `OriginEndpoint` previously stored the configuration but
did not by itself produce a working endpoint policy — the
`CdnAuthConfiguration` block on `OriginEndpointPolicy` is non-functional
without an accompanying gating policy statement that requires the matching
`mediapackagev2:RequestHasMatchingCdnAuthHeader` condition. Per the AWS docs
[1], both the gating statement and the configuration block are required.

This change:

- Auto-emits the AWS-documented gating policy statement when `cdnAuth` is set
  on `OriginEndpointProps`. The resulting `OriginEndpointPolicy` now contains
  both the gating statement and the `CdnAuthConfiguration` block.
- Drops the optional `cdnAuth` second argument from `addToResourcePolicy(...)`
  on `IOriginEndpoint` — the field had no clean home there and only the first
  call ever applied. CDN auth now lives only on the endpoint props.
- Drops the `cdnAuth` prop on `MediaPackageV2OriginProps` for the same
  reason — set `cdnAuth` on the `OriginEndpoint` directly.
- Adds an integ test that deploys the full pipeline.
- Updates the README to document the new pattern, including the JSON shape
  the secret must use (`MediaPackageV2CDNIdentifier` key).

[1] https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth-setup.html

BREAKING CHANGE: `OriginEndpoint.addToResourcePolicy()` no longer accepts an
optional `cdnAuth` second argument. `MediaPackageV2OriginProps.cdnAuth` has
been removed. Set `cdnAuth` on `OriginEndpointProps` instead.

### Describe any new or updated permissions being added




### Description of how you validated changes



### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: jamiepmullan

packages/@aws-cdk/aws-mediapackagev2-alpha/README.md

@@ -243,6 +243,50 @@ origin.addToResourcePolicy(new PolicyStatement({
 }));
 ```
 
+### CDN Authorization
+
+MediaPackage V2 supports two ways to lock an origin endpoint to your CDN:
+
+- **AWS Signature Version 4 (SigV4)** — the CDN signs requests with an IAM
+  role. For Amazon CloudFront, see [CloudFront Integration](#cloudfront-integration).
+  See the [SigV4 authentication guide][sigv4-auth].
+- **Header-based CDN authorization** — the CDN attaches a shared secret in
+  a request header that MediaPackage validates. Use this when your CDN
+  doesn't support SigV4. See the [CDN authorization guide][cdn-auth].
+
+[sigv4-auth]: https://docs.aws.amazon.com/mediapackage/latest/userguide/sig-v4-authenticating-requests.html
+[cdn-auth]: https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth.html
+
+To configure header-based authorization, set `cdnAuth` on the `OriginEndpoint`
+props. The L2 auto-creates the endpoint policy with:
+
+- a `PolicyStatement` requiring the `mediapackagev2:RequestHasMatchingCdnAuthHeader`
+  condition on every `GetObject` request
+- the `CdnAuthConfiguration` block that references the secrets and the read role
+
+If you don't supply a role, one is created with the needed Secrets Manager
+and KMS permissions.
+
+```ts
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+
+declare const channel: Channel;
+declare const mySecret: secretsmanager.ISecret;
+
+new OriginEndpoint(this, 'OriginEndpoint', {
+  channel,
+  segment: Segment.ts(),
+  manifests: [Manifest.hls({ manifestName: 'index' })],
+  cdnAuth: {
+    secrets: [mySecret],
+  },
+});
+```
+
+You can still call `addToResourcePolicy()` to add extra statements (e.g. a
+harvester allow); they're appended to the auto-created policy alongside the
+gating statement.
+
 ## Granting Permissions
 
 ### Granting Ingest Access to MediaLive

packages/@aws-cdk/aws-mediapackagev2-alpha/lib/cloudfront-origin.ts

@@ -6,7 +6,6 @@ import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 import type { Construct } from 'constructs';
 import type { IOriginEndpoint } from './endpoint';
 import type { IChannelGroup } from './group';
-import type { CdnAuthConfiguration } from './origin-endpoint-policy';
 
 /**
  * Properties for a MediaPackage V2 Origin with OAC.
@@ -25,17 +24,6 @@ export interface MediaPackageV2OriginProps extends cloudfront.OriginProps {
    * @default - an Origin Access Control will be created automatically.
    */
   readonly originAccessControl?: cloudfront.IOriginAccessControlRef;
-
-  /**
-   * Optional CDN authorization configuration.
-   *
-   * If you need CDN auth on this endpoint, provide it here so it is configured
-   * on the first `addToResourcePolicy` call. If CDN auth is added separately
-   * after this origin is bound, it will be ignored.
-   *
-   * @default - no CDN authorization
-   */
-  readonly cdnAuth?: CdnAuthConfiguration;
 }
 
 /**
@@ -66,7 +54,6 @@ export interface MediaPackageV2OriginProps extends cloudfront.OriginProps {
 export class MediaPackageV2Origin extends cloudfront.OriginBase {
   private originAccessControl?: cloudfront.IOriginAccessControlRef;
   private readonly endpoint: IOriginEndpoint;
-  private readonly cdnAuth?: CdnAuthConfiguration;
 
   constructor(endpoint: IOriginEndpoint, props: MediaPackageV2OriginProps) {
     if (!props.channelGroup.egressDomain) {
@@ -78,7 +65,6 @@ export class MediaPackageV2Origin extends cloudfront.OriginBase {
     super(props.channelGroup.egressDomain, props);
     this.endpoint = endpoint;
     this.originAccessControl = props.originAccessControl;
-    this.cdnAuth = props.cdnAuth;
   }
 
   protected renderCustomOriginConfig(): cloudfront.CfnDistribution.CustomOriginConfigProperty | undefined {
@@ -116,7 +102,6 @@ export class MediaPackageV2Origin extends cloudfront.OriginBase {
           },
         },
       }),
-      this.cdnAuth,
     );
 
     return {

packages/@aws-cdk/aws-mediapackagev2-alpha/lib/endpoint.ts

@@ -3,7 +3,8 @@ import { RemovalPolicy, ArnFormat, Duration, Fn, Lazy, Names, Resource, Stack, T
 import type { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import type { MetricOptions } from 'aws-cdk-lib/aws-cloudwatch';
 import { Metric, Unit } from 'aws-cdk-lib/aws-cloudwatch';
-import type { IRole, PolicyStatement, AddToResourcePolicyResult } from 'aws-cdk-lib/aws-iam';
+import type { IRole, AddToResourcePolicyResult } from 'aws-cdk-lib/aws-iam';
+import { Effect, PolicyStatement, StarPrincipal } from 'aws-cdk-lib/aws-iam';
 import { CfnOriginEndpoint } from 'aws-cdk-lib/aws-mediapackagev2';
 import type { IOriginEndpointRef, OriginEndpointReference } from 'aws-cdk-lib/aws-mediapackagev2';
 import { ValidationError, UnscopedValidationError, CfnResource } from 'aws-cdk-lib/core';
@@ -1054,9 +1055,8 @@ export interface IOriginEndpoint extends IResource, IOriginEndpointRef {
    * If you have already defined one, it will append to the policy already created.
    *
    * @param statement - The policy statement to add
-   * @param cdnAuth - Optional CDN authorization configuration. Only the first CDN auth configuration is used if provided multiple times.
    */
-  addToResourcePolicy(statement: PolicyStatement, cdnAuth?: CdnAuthConfiguration): AddToResourcePolicyResult;
+  addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
 
   /**
    * Create a CloudWatch metric.
@@ -1829,6 +1829,35 @@ export interface OriginEndpointOptions {
   /**
    * Provide access to MediaPackage V2 Origin Endpoint via secret header.
    *
+   * Use this when your CDN doesn't support AWS Signature Version 4 (SigV4)
+   * authentication. For SigV4-based access with Amazon CloudFront, see
+   * `MediaPackageV2Origin`.
+   *
+   * Setting `cdnAuth` auto-creates the following policy on the OriginEndpoint:
+   *
+   * ```json
+   * {
+   *   "Version":"2012-10-17",
+   *   "Statement": [
+   *     {
+   *       "Sid": "AllowGetObjectAccessForAuthorizedRequest",
+   *       "Effect": "Allow",
+   *       "Principal": "*",
+   *       "Action": "mediapackagev2:GetObject",
+   *       "Resource": "arn:aws:mediapackagev2:us-east-1:111122223333:channelGroup/channelGroupName/channel/channelName/originEndpoint/originEndpointName",
+   *       "Condition": {
+   *         "Bool": {
+   *           "mediapackagev2:RequestHasMatchingCdnAuthHeader": "true"
+   *         }
+   *       }
+   *     }
+   *   ]
+   * }
+   * ```
+   *
+   * @see https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth.html
+   * @see https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth-setup.html
+   *
    * @default undefined - Not configured on endpoint
    */
   readonly cdnAuth?: CdnAuthConfiguration;
@@ -2653,36 +2682,21 @@ abstract class OriginEndpointBase extends Resource implements IOriginEndpoint {
 
   /**
    * CDN authorization configuration to be applied when the policy is created.
+   * Set by subclass constructors when `cdnAuth` is provided in props.
    */
-  private cdnAuthConfig?: CdnAuthConfiguration;
-
-  /**
-   * Set CDN auth config. Used by subclass constructors.
-   * @internal
-   */
-  protected _setCdnAuth(cdnAuth: CdnAuthConfiguration): void {
-    if (!this.cdnAuthConfig) {
-      this.cdnAuthConfig = cdnAuth;
-    }
-  }
+  protected cdnAuthConfig?: CdnAuthConfiguration;
 
   /**
    * Configure origin endpoint policy.
    *
-   * You can only add 1 OriginEndpointPolicy to an OriginEndpoint.
-   * If you have already defined one, it will append to the policy already created.
+   * You can only add 1 OriginEndpointPolicy to an OriginEndpoint. If you have already
+   * defined one, this will append to the policy already created.
+   *
+   * To configure CDN authentication, set `cdnAuth` on the construct's props instead.
    *
    * @param statement - The policy statement to add
-   * @param cdnAuth - Optional CDN authorization configuration. If provided, the policy will be
-   *                  created with CDN authentication enabled using secrets from AWS Secrets Manager.
-   *                  If cdnAuth is provided multiple times, only the first configuration is used.
-   */
-  public addToResourcePolicy(statement: PolicyStatement, cdnAuth?: CdnAuthConfiguration): AddToResourcePolicyResult {
-    // Store CDN auth config if provided (only if not already set)
-    if (cdnAuth && !this.cdnAuthConfig) {
-      this.cdnAuthConfig = cdnAuth;
-    }
-
+   */
+  public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult {
     if (!this.policy && this.autoCreatePolicy) {
       this.policy = new OriginEndpointPolicy(this, 'Policy', {
         originEndpoint: this,
@@ -3012,9 +3026,32 @@ export class OriginEndpoint extends OriginEndpointBase implements IOriginEndpoin
 
     origin.applyRemovalPolicy(props?.removalPolicy ?? RemovalPolicy.DESTROY);
 
-    // Pre-set CDN auth config if provided in props
+    // When cdnAuth is set, pre-create the endpoint policy with the AWS-recommended gating
+    // statement. The principal is `*` (anonymous) because CDN requests to MediaPackage are
+    // unsigned HTTPS — only the matching CDN-Identifier header proves authorisation.
+    // See https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth-setup.html
     if (props.cdnAuth) {
-      this._setCdnAuth(props.cdnAuth);
+      if (props.cdnAuth.secrets.length === 0) {
+        throw new ValidationError(
+          lit`CdnAuthSecretsRequired`,
+          'cdnAuth.secrets must contain at least one secret. CDN authorization needs a secret to validate incoming CDN-Identifier headers.',
+          this,
+        );
+      }
+
+      this.cdnAuthConfig = props.cdnAuth;
+      this.addToResourcePolicy(new PolicyStatement({
+        sid: 'AllowGetObjectAccessForAuthorizedRequest',
+        effect: Effect.ALLOW,
+        principals: [new StarPrincipal()],
+        actions: ['mediapackagev2:GetObject'],
+        resources: [this.originEndpointArn],
+        conditions: {
+          Bool: {
+            'mediapackagev2:RequestHasMatchingCdnAuthHeader': 'true',
+          },
+        },
+      }));
     }
   }
 }

packages/@aws-cdk/aws-mediapackagev2-alpha/lib/origin-endpoint-policy.ts

@@ -16,6 +16,10 @@ import type { IOriginEndpoint } from './endpoint';
 export interface CdnAuthConfiguration {
   /**
    * Secrets to use for CDN authorization.
+   *
+   * Each secret must be a JSON object with a `MediaPackageV2CDNIdentifier` key whose
+   * value is the CDN-Identifier header value. See the
+   * {@link https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth-setup.html | MediaPackage CDN authorization docs}.
    */
   readonly secrets: ISecret[];
   /**

packages/@aws-cdk/aws-mediapackagev2-alpha/test/cloudfront-origin.test.ts

@@ -232,40 +232,70 @@ test('distribution origin uses egress domain and OAC ID', () => {
   });
 });
 
-test('MediaPackageV2Origin with cdnAuth configures endpoint policy', () => {
+test('MediaPackageV2Origin works alongside cdnAuth set on the endpoint props', () => {
   const group = new mediapackagev2.ChannelGroup(stack, 'Group', {
     channelGroupName: 'test-group',
   });
   const channel = new mediapackagev2.Channel(stack, 'Channel', {
     channelGroup: group,
     channelName: 'test-channel',
   });
+  const secret = new Secret(stack, 'CdnSecret');
+
   const endpoint = new mediapackagev2.OriginEndpoint(stack, 'Endpoint', {
     channel,
     originEndpointName: 'test-endpoint',
     segment: mediapackagev2.Segment.cmaf(),
     manifests: [mediapackagev2.Manifest.hls({ manifestName: 'index' })],
+    cdnAuth: {
+      secrets: [secret],
+    },
   });
 
-  const secret = new Secret(stack, 'CdnSecret');
-
   new cloudfront.Distribution(stack, 'Dist', {
     defaultBehavior: {
       origin: new mediapackagev2.MediaPackageV2Origin(endpoint, {
         channelGroup: group,
-        cdnAuth: {
-          secrets: [secret],
-        },
       }),
     },
   });
 
   const template = Template.fromStack(stack);
 
-  // CDN auth configuration is present on the endpoint policy
   template.hasResourceProperties('AWS::MediaPackageV2::OriginEndpointPolicy', {
     CdnAuthConfiguration: Match.objectLike({
       CdnIdentifierSecretArns: Match.anyValue(),
     }),
+    Policy: {
+      Version: '2012-10-17',
+      Statement: [
+        // cdnAuth gating statement — third-party CDN with header check
+        {
+          Sid: 'AllowGetObjectAccessForAuthorizedRequest',
+          Effect: 'Allow',
+          Principal: '*',
+          Action: 'mediapackagev2:GetObject',
+          Resource: { 'Fn::GetAtt': [Match.stringLikeRegexp('Endpoint'), 'Arn'] },
+          Condition: {
+            Bool: {
+              'mediapackagev2:RequestHasMatchingCdnAuthHeader': 'true',
+            },
+          },
+        },
+        // OAC SigV4 statement — CloudFront via service principal
+        {
+          Sid: 'AllowCloudFrontServicePrincipal',
+          Effect: 'Allow',
+          Principal: { Service: 'cloudfront.amazonaws.com' },
+          Action: ['mediapackagev2:GetObject', 'mediapackagev2:GetHeadObject'],
+          Resource: { 'Fn::GetAtt': [Match.stringLikeRegexp('Endpoint'), 'Arn'] },
+          Condition: {
+            StringEquals: {
+              'aws:SourceArn': Match.anyValue(),
+            },
+          },
+        },
+      ],
+    },
   });
 });