Create Amazon CloudFront Key Pairs

Objective

To generate an Amazon CloudFront key pair so that you can create signed URLs to access private content from a CloudFront distribution.

Table of Contents

Prerequisites

AWS Account with the CloudFront Service enabled. 

Overview

CloudFront uses access keys to authenticate requests you make to CloudFront.  Trusted signers with at least one CloudFront key pair can create signed URLs that can be used to temporarily access private content that's stored in your origin server (S3 bucket).

Unfortunately, you cannot create CloudFront Key Pairs inside the Dashboard.  You must create them using the AWS Management Console.

Steps

• Log into your AWS Account at http://aws.amazon.com.
• Go to Account -> Security Credentials.
• Under "Access Credentials" click the "Key Pairs" tab.
• You can either create a new key pair or upload the public key of an existing key pair.

Each CloudFront key pair includes a public key, private key, and an ID for the key pair.  You can only have up to two key pairs per AWS account. 

Here is an example of a signed url:

http://mybucket.amazonaws.com/image.png?AWSAccessKeyId=YW6OAKIAAKIAJQCRVTSRQ&Expires=1274228859&Signature=OlnE7O5PSMz4pzaE7O5PRKD/ws%3D

Notice that the signed url contains the public CloudFront Access Key ID and an expiration date (default = 24 hrs).