AccessDenied policy auth_error ai_generated true

访问被拒绝：请求无法满足。密钥对ID 'K12345678'对此分配无效。

AccessDenied: The request could not be satisfied. The key pair ID 'K12345678' is not valid for this distribution.

ID: policy/cloudfront-signed-url-expired

其他格式: JSON · Markdown 中文 · English
90%修复率
85%置信度
1证据数
2024-03-15首次发现

版本兼容性

版本状态引入弃用备注
AWS CloudFront (2024-01) active — — —
AWS SDK v2 active — — —

根因分析

CloudFront签名URL使用了过期或已吊销的密钥对ID，导致所有请求失败。

English

CloudFront signed URL uses an expired or revoked key pair ID, causing all requests to fail.

generic

官方文档

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html

解决方案

  1. Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.
  2. If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.

无效尝试

常见但无效的做法:

  1. 60% 失败

    The key pair ID is invalid, not the URL format. Regenerating doesn't fix the root cause.

  2. 70% 失败

    The console shows the key pair ID, but the actual key material may be expired or mismatched.

  3. 90% 失败

    CloudFront does not automatically rotate key pairs; manual intervention is required.