# AccessDenied: The request could not be satisfied. The key pair ID 'K12345678' is not valid for this distribution.

- **ID:** `policy/cloudfront-signed-url-expired`
- **Domain:** policy
- **Category:** auth_error
- **Error Code:** `AccessDenied`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

CloudFront signed URL uses an expired or revoked key pair ID, causing all requests to fail.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| AWS CloudFront (2024-01) | active | — | — |
| AWS SDK v2 | active | — | — |

## Workarounds

1. **Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.** (90% success)
   ```
   Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.
   ```
2. **If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.** (80% success)
   ```
   If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.
   ```

## Dead Ends

- **** — The key pair ID is invalid, not the URL format. Regenerating doesn't fix the root cause. (60% fail)
- **** — The console shows the key pair ID, but the actual key material may be expired or mismatched. (70% fail)
- **** — CloudFront does not automatically rotate key pairs; manual intervention is required. (90% fail)