{
  "slug": "aws-cloudfront-sign-supports-ecdsa-sha-256-and-wildcard-policies-a0fd60296868",
  "title": "aws cloudfront sign supports ECDSA, SHA-256, and wildcard policies",
  "tools": [
    "aws-cli"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-27T18:12:56.000Z",
  "announced_at": "2026-10-27T18:12:56.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When you need a signed CloudFront URL for protected build output, run `aws cloudfront sign` with the content URL, active key pair ID, PEM private key, and expiration. For wildcard access, set `--policy-resource`; ECDSA keys must be P-256 and use SHA-256.",
    "examples": [
      "aws cloudfront sign --url <https://distribution.example/path/build.tar.gz> --key-pair-id <key-pair-id> --private-key fileb://<private-key.pem> --date-less-than <YYYY-MM-DDThh:mm:ssZ> --hash-algorithm SHA256",
      "aws cloudfront sign --url <https://distribution.example/path/build.tar.gz> --policy-resource 'https://distribution.example/path/*' --key-pair-id <key-pair-id> --private-key fileb://<private-key.pem> --date-less-than <YYYY-MM-DDThh:mm:ssZ> --hash-algorithm SHA256"
    ],
    "gotchas": [
      "Version: 2.39.0",
      "Non-interactive: Writes the signed URL to stdout; returns 0 on success.",
      "Non-interactive: ECDSA PEM key must include its public key; only P-256 is supported.",
      "--policy-resource <value>: Policy resource; allows `*` and `?`; defaults to `--url` and URL must match it.",
      "--private-key <value> (required): PEM key via `file://` or `fileb://`; RSA and ECDSA P-256 supported.",
      "--hash-algorithm <SHA1|SHA256>: Selects signing hash; ECDSA uses SHA256 only.",
      "--key-pair-id <value> (required): Active CloudFront key pair ID.",
      "--date-less-than <value> (required): URL expiration date/time.",
      "--url <value> (required): Absolute HTTP(S) URL without fragment or signing parameters.",
      "Input that would produce a URL CloudFront rejects is rejected."
    ]
  },
  "why_it_matters": "Generate a CloudFront signed URL for a repository workflow that needs to distribute protected build output.",
  "sources": [
    "https://github.com/aws/aws-cli/blob/2.39.0/CHANGELOG.rst",
    "https://github.com/aws/aws-cli/blob/2.39.0/awscli/customizations/cloudfront/sign.py"
  ],
  "rank": 0.92015,
  "review_state": "approved",
  "provenance": {
    "run_id": "daily-20261027-20",
    "verdict_id": "daily-20261027-20:daily-20261027-20-28e489ac32cf85c9-1:gate",
    "evidence_hash": "13fe0063062c016aaedb3607fcc6275c08288b748642bb77ddd1dd942847a6fd"
  }
}