code: def cloudfront_origin_access_identity_oai_canonical_user_id(self, lookup, default=None):
      
      # list_cloud_front_origin_access_identities returns at most 100 oai's per request
      list_limit = "100"
      oais = EFAwsResolver.__CLIENTS["cloudfront"].list_cloud_front_origin_access_identities(
        MaxItems=list_limit)["CloudFrontOriginAccessIdentityList"]
      # Return if the account has no OriginAccessIdentities
      if not oais.has_key("Items"):
        return default
      while True:
        for oai in oais["Items"]:
          if oai["Comment"] == lookup:
            return oai["S3CanonicalUserId"]
        if oais["IsTruncated"]:
          oais = EFAwsResolver.__CLIENTS["cloudfront"].list_cloud_front_origin_access_identities(
            MaxItems=list_limit, Marker=oais["NextMarker"])["CloudFrontOriginAccessIdentityList"]
        else:
          return default
docs: Args:
        lookup: the FQDN of the Origin Access Identity (from its comments)
        default: the optional value to return if lookup failed; returns None if not set
      Returns:
        the S3 Canonical User ID of the OAI associated with the named FQDN in 'lookup', or default/None if no match