use IPublicKey as items param in KeyGroupProps

packages/@aws-cdk/aws-cloudfront/lib/key-group.ts

@@ -1,6 +1,7 @@
 import { Resource } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnKeyGroup } from './cloudfront.generated';
+import { IPublicKey } from './public-key';
 
 /**
  * Represents a Key Group
@@ -32,7 +33,7 @@ export interface KeyGroupProps {
   /**
    * A list of the identifiers of the public keys in the key group.
    */
-  readonly items?: string[];
+  readonly items: IPublicKey[];
 }
 
 /**
@@ -42,6 +43,7 @@ export interface KeyGroupProps {
  */
 export class KeyGroup extends Resource implements IKeyGroup {
 
+  /** Imports a Key Group from its id. */
   public static fromKeyGroupId(scope: Construct, id: string, keyGroupId: string): IKeyGroup {
     return new class extends Resource implements IKeyGroup {
       public readonly keyGroupId = keyGroupId;
@@ -59,10 +61,15 @@ export class KeyGroup extends Resource implements IKeyGroup {
       keyGroupConfig: {
         name: props.keyGroupName, //TODO: We can always add validation -- once known later
         comment: props.comment,
-        items: props.items ?? [],
+        items: this.getKeyIdentifiers(props.items),
       },
     });
-
     this.keyGroupId = resource.ref;
   }
+
+  private getKeyIdentifiers(items: IPublicKey[]): string[] {
+    return items.map((key)=> {
+      return key.publicKeyId;
+    });
+  }
 }

packages/@aws-cdk/aws-cloudfront/lib/public-key.ts

@@ -43,6 +43,8 @@ export interface PublicKeyProps {
  * @resource AWS::CloudFront::KeyGroup
  */
 export class PublicKey extends Resource implements IPublicKey {
+
+  /** Imports a Public Key from its id. */
   public static fromPublicKeyId(scope: Construct, id: string, publicKeyId: string): IPublicKey {
     return new class extends Resource implements IPublicKey {
       public readonly publicKeyId = publicKeyId;