diff --git a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
index 6f82b5afcf73c..d2003c9285571 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
+++ b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
@@ -84,6 +84,6 @@ class S3BucketOrigin extends cloudfront.OriginBase {
   }
 
   protected renderS3OriginConfig(): cloudfront.CfnDistribution.S3OriginConfigProperty | undefined {
-    return { originAccessIdentity: `origin-access-identity/cloudfront/${this.originAccessIdentity.originAccessIdentityName}` };
+    return { originAccessIdentity: `origin-access-identity/cloudfront/${this.originAccessIdentity.originAccessIdentityId}` };
   }
 }
diff --git a/packages/@aws-cdk/aws-cloudfront/lib/origin-access-identity.ts b/packages/@aws-cdk/aws-cloudfront/lib/origin-access-identity.ts
index 5cef00c1c1d8c..449f801b1089d 100644
--- a/packages/@aws-cdk/aws-cloudfront/lib/origin-access-identity.ts
+++ b/packages/@aws-cdk/aws-cloudfront/lib/origin-access-identity.ts
@@ -20,7 +20,10 @@ export interface OriginAccessIdentityProps {
  */
 export interface IOriginAccessIdentity extends cdk.IResource, iam.IGrantable {
   /**
-   * The Origin Access Identity Name
+   * The Origin Access Identity Id (physical id)
+   * It is misnamed and superseded by the correctly named originAccessIdentityId
+   *
+   * @deprecated use originAccessIdentityId instead
    */
   readonly originAccessIdentityName: string;
 
@@ -33,7 +36,10 @@ export interface IOriginAccessIdentity extends cdk.IResource, iam.IGrantable {
 
 abstract class OriginAccessIdentityBase extends cdk.Resource {
   /**
-   * The Origin Access Identity Name (physical id)
+   * The Origin Access Identity Id (physical id)
+   * It is misnamed and superseded by the correctly named originAccessIdentityId
+   *
+   * @deprecated use originAccessIdentityId instead
    */
   public abstract readonly originAccessIdentityName: string;
 
@@ -120,9 +126,11 @@ export class OriginAccessIdentity extends OriginAccessIdentityBase implements IO
   public readonly grantPrincipal: iam.IPrincipal;
 
   /**
-   * The Origin Access Identity Name (physical id)
+   * The Origin Access Identity Id (physical id)
+   * It is misnamed and superseded by the correctly named originAccessIdentityId
    *
    * @attribute
+   * @deprecated use originAccessIdentityId instead
    */
   public get originAccessIdentityName() {
     return this.originAccessIdentityId;
diff --git a/packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts b/packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts
index 2fb0d5d958dc0..1dc5e570c264a 100644
--- a/packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts
+++ b/packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts
@@ -1107,7 +1107,7 @@ export class CloudFrontWebDistribution extends cdk.Resource implements IDistribu
         }));
 
         s3OriginConfig = {
-          originAccessIdentity: `origin-access-identity/cloudfront/${originConfig.s3OriginSource.originAccessIdentity.originAccessIdentityName}`,
+          originAccessIdentity: `origin-access-identity/cloudfront/${originConfig.s3OriginSource.originAccessIdentity.originAccessIdentityId}`,
         };
       } else {
         s3OriginConfig = {};