AccessDenied policy auth_error ai_generated true

AccessDenied: The request could not be satisfied. The key pair ID 'K12345678' is not valid for this distribution.

ID: policy/cloudfront-signed-url-expired

Also available as: JSON · Markdown · 中文
90%Fix Rate
85%Confidence
1Evidence
2024-03-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
AWS CloudFront (2024-01) active — — —
AWS SDK v2 active — — —

Root Cause

CloudFront signed URL uses an expired or revoked key pair ID, causing all requests to fail.

generic

中文

CloudFront签名URL使用了过期或已吊销的密钥对ID，导致所有请求失败。

Official Documentation

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html

Workarounds

  1. 90% success Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID. 
    Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.
  2. 80% success If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency. 
    If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.

中文步骤

  1. Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.
  2. If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.

Dead Ends

Common approaches that don't work:

  1. 60% fail

    The key pair ID is invalid, not the URL format. Regenerating doesn't fix the root cause.

  2. 70% fail

    The console shows the key pair ID, but the actual key material may be expired or mismatched.

  3. 90% fail

    CloudFront does not automatically rotate key pairs; manual intervention is required.