# 访问被拒绝：请求无法满足。密钥对ID 'K12345678'对此分配无效。

- **ID:** `policy/cloudfront-signed-url-expired`
- **领域:** policy
- **类别:** auth_error
- **错误码:** `AccessDenied`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

CloudFront签名URL使用了过期或已吊销的密钥对ID，导致所有请求失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| AWS CloudFront (2024-01) | active | — | — |
| AWS SDK v2 | active | — | — |

## 解决方案

1. ```
   Generate a new CloudFront key pair using AWS CLI: `aws cloudfront create-public-key --public-key-config '{"CallerReference":"my-key-2024","Name":"my-key","EncodedKey":"<public_key_pem>"}'`, then update the distribution to use the new key pair ID.
   ```
2. ```
   If using a custom origin, switch to signed cookies instead of signed URLs to avoid key pair dependency.
   ```

## 无效尝试

- **** — The key pair ID is invalid, not the URL format. Regenerating doesn't fix the root cause. (60% 失败率)
- **** — The console shows the key pair ID, but the actual key material may be expired or mismatched. (70% 失败率)
- **** — CloudFront does not automatically rotate key pairs; manual intervention is required. (90% 失败率)