diff --git a/packages/aws-cdk-lib/aws-cloudfront/lib/cache-policy.ts b/packages/aws-cdk-lib/aws-cloudfront/lib/cache-policy.ts
index ab123d9949f54..c9e1e94af0a00 100644
--- a/packages/aws-cdk-lib/aws-cloudfront/lib/cache-policy.ts
+++ b/packages/aws-cdk-lib/aws-cloudfront/lib/cache-policy.ts
@@ -26,6 +26,9 @@ export interface CachePolicyProps {
 
   /**
    * A comment to describe the cache policy.
+   *
+   * The comment cannot be longer than 128 characters.
+   *
    * @default - no comment
    */
   readonly comment?: string;
@@ -149,6 +152,10 @@ export class CachePolicy extends Resource implements ICachePolicy {
       throw new Error(`'cachePolicyName' cannot be longer than 128 characters, got: '${cachePolicyName.length}'`);
     }
 
+    if (props.comment && !Token.isUnresolved(props.comment) && props.comment.length > 128) {
+      throw new Error(`'comment' cannot be longer than 128 characters, got: ${props.comment.length}`);
+    }
+
     const minTtl = (props.minTtl ?? Duration.seconds(0)).toSeconds();
     let defaultTtl = (props.defaultTtl ?? Duration.days(1)).toSeconds();
     let maxTtl = (props.maxTtl ?? Duration.days(365)).toSeconds();
diff --git a/packages/aws-cdk-lib/aws-cloudfront/test/cache-policy.test.ts b/packages/aws-cdk-lib/aws-cloudfront/test/cache-policy.test.ts
index bd30650bc0ea5..44bfd52d19c84 100644
--- a/packages/aws-cdk-lib/aws-cloudfront/test/cache-policy.test.ts
+++ b/packages/aws-cdk-lib/aws-cloudfront/test/cache-policy.test.ts
@@ -108,6 +108,11 @@ describe('CachePolicy', () => {
     })).not.toThrow();
   });
 
+  test('throws on long comment over 128 characters', () => {
+    const errorMessage = /'comment' cannot be longer than 128 characters, got: 129/;
+    expect(() => new CachePolicy(stack, 'CachePolicy1', { comment: 'a'.repeat(129) })).toThrow(errorMessage);
+  });
+
   describe('TTLs', () => {
     test('default TTLs', () => {
       new CachePolicy(stack, 'CachePolicy', { cachePolicyName: 'MyPolicy' });