Issues generating CloudFront signed URLs; always Access Denied

Question

I’m having issues generating signed URLs with CloudFront. Whatever I try, I just get an “Access Denied” response.

I’ve created a distribution in CloudFront, and a CloudFront key pair ID. I’ve downloaded the private and public keys for that key pair ID.

In a simple PHP script, I’m trying the following:

use Aws\CloudFront\CloudFrontClient; $cloudfront = new CloudFrontClient([ 'credentials' => [ 'key' => '[redacted]', // Access key ID of IAM user with Administrator policy 'secret' => '[redacted]', // Secret access key of same IAM user ], 'debug' => true, 'region' => 'eu-west-1', 'version' => 'latest', ]); $expires = strtotime('+6 hours'); $resource = 'https://[redacted].cloudfront.net/mp4/bunny-trailer.mp4'; $url = $cloudfront->getSignedUrl([ 'url' => $resource, 'policy' => json_encode([ 'Statement' => [ [ 'Resource' => $resource, 'Condition' => [ 'DateLessThan' => [ 'AWS:EpochTime' => $expires, ], ], ], ], ]), 'expires' => $expires, 'key_pair_id' => '[redacted]', // Access key ID of CloudFront key pair 'private_key' => '[redacted]', // Relative path to pk-[redacted].pem file ]);

But when visiting the generated URL, it just always gives me an error in the browser with a code of “AccessDenied”.

What am I doing wrong?

Any particular reason for creating that custom policy instead of using the default, as you already set expires on the signed url? Not necessarily the issue, I am just trying to eliminate variables. — colde
– colde, Commented Jul 14, 2018 at 13:50
@colde I was wanting to restrict to IP address as well, but can’t get it working with just an expiry time without adding more conditions. — Martin Bean
– Martin Bean, Commented Jul 14, 2018 at 19:54
So even without the specific policy it doesn't work? Besides missing possible query string parameters, i don't have any immediate ideas them. — colde
– colde, Commented Jul 15, 2018 at 21:03

Martin Bean · Accepted Answer · 2018-07-18 08:27:16Z

Discovered what the issue was. The objects in my S3 bucket weren’t publicly-accessible, and I hadn’t added an Origin Access Identity, so CloudFront couldn’t pull the objects from my origin (my S3 bucket) to cache them.

As soon as I added an Origin Access Identity and added it to my S3 bucket’s policy, my objects immediately became accessible through my CloudFront distribution via signed URLs.

Relevant documentation: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-creating-oai

Collectives™ on Stack Overflow

Issues generating CloudFront signed URLs; always Access Denied

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related