Can't use S3OriginConfig in CF distribution

Serverless Framework
1

I’ve read up a bit on aws intrinsic functions but still confused on when I can use them in serverless.yml.

I’d like to set the “S3OriginConfig” attribute on a cloudfront distribution and am looking at something like this:

         "S3OriginConfig": {
            "OriginAccessIdentity": {"Fn::Join": [ "", [
              "origin-access-identity/cloudfront/",
              { "Fn::GetAtt": [ "MySiteOAI", "OriginAccessIdentity" ] } ]]}
          }

But it doesn’t work - is there another way I can use that config without manually handling identifiers?

The error is

Fn::GetAtt references undefined resource OriginAccessIdentity