sincecutoff.com
llms.txt /v1/json
← all changes

aws cloudfront sign supports ECDSA, SHA-256, and wildcard policies

Introduced 2026-10-27 · score 0.92

HOW TO USE IT

When you need a signed CloudFront URL for protected build output, run `aws cloudfront sign` with the content URL, active key pair ID, PEM private key, and expiration. For wildcard access, set `--policy-resource`; ECDSA keys must be P-256 and use SHA-256.

aws cloudfront sign --url <https://distribution.example/path/build.tar.gz> --key-pair-id <key-pair-id> --private-key fileb://<private-key.pem> --date-less-than <YYYY-MM-DDThh:mm:ssZ> --hash-algorithm SHA256
aws cloudfront sign --url <https://distribution.example/path/build.tar.gz> --policy-resource 'https://distribution.example/path/*' --key-pair-id <key-pair-id> --private-key fileb://<private-key.pem> --date-less-than <YYYY-MM-DDThh:mm:ssZ> --hash-algorithm SHA256

WHY THIS HELPS

Generate a CloudFront signed URL for a repository workflow that needs to distribute protected build output.

REQUIREMENTS AND LIMITATIONS

  • Version: 2.39.0
  • Non-interactive: Writes the signed URL to stdout; returns 0 on success.
  • Non-interactive: ECDSA PEM key must include its public key; only P-256 is supported.
  • --policy-resource <value>: Policy resource; allows `*` and `?`; defaults to `--url` and URL must match it.
  • --private-key <value> (required): PEM key via `file://` or `fileb://`; RSA and ECDSA P-256 supported.
  • --hash-algorithm <SHA1|SHA256>: Selects signing hash; ECDSA uses SHA256 only.
  • --key-pair-id <value> (required): Active CloudFront key pair ID.
  • --date-less-than <value> (required): URL expiration date/time.
  • --url <value> (required): Absolute HTTP(S) URL without fragment or signing parameters.
  • Input that would produce a URL CloudFront rejects is rejected.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card