Amplify publish failed - Missing cloudfront permission for user

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

v17.3

### Amplify CLI Version

7.6.19

### What operating system are you using?

Macos

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

None

### Amplify Categories

hosting

### Amplify Commands

publish

### Describe the bug

Created user through config walkthrough. This created a user with [AdministratorAccess-Amplify] policy. Pulled existing backend. Add hosting using S3 and production.

Publish started for S3AndCloudFront
An error occurred during the publish operation: User: arn:aws:iam::xxx:user/xx is not authorized to perform: cloudfront:GetCloudFrontOriginAccessIdentity on resource: arn:aws:cloudfront::xx:origin-access-identity/xx because no identity-based policy allows the cloudfront:GetCloudFrontOriginAccessIdentity action

Added CloudFrontFullAccess policy to user and the publish succeeded.

### Expected behavior

No error.

### Reproduction steps

amplify configure
create new user
amplify pull existing
amplify add hosting
s3 production
amplify publish

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

Reproduce the reported sequence with `amplify configure`, `amplify pull`, `amplify add hosting`, and `amplify publish` using the stated CLI and Node versions. Compare the permissions granted by `AdministratorAccess-Amplify` with the missing CloudFront action, then verify that publishing succeeds without manually adding `CloudFrontFullAccess`.

Written by the indexing model from the issue text.