CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

By Ravindra Bagale, trainer · LinkedIn · Last updated: 22 October 2026

1. A story: the cinema ticket

A cinema has one door (CloudFront) and a projection room (S3). Two rules keep it fair. First, the projection room only opens for the cinema staff, never for the street. Second, the door lets you in only with a ticket for this show, and the ticket is useless after the show starts.

Rule one is OAC. Rule two is a signed URL or signed cookie.

2. OAC vs OAI

Why do we need this?

If the bucket is public, anyone can skip CloudFront, its signed URLs and its WAF, and download straight from S3.

What is it?

OAC bucket policy

{"Version":"2012-10-17","Statement":[{"Sid":"AllowCloudFrontOAC","Effect":"Allow",
 "Principal":{"Service":"cloudfront.amazonaws.com"},
 "Action":"s3:GetObject","Resource":"arn:aws:s3:::course-videos/*",
 "Condition":{"StringEquals":{"AWS:SourceArn":"arn:aws:cloudfront::111122223333:distribution/E1ABCDEF2GHIJ"}}}]}

Why the condition: without it, any CloudFront distribution in any account could read your bucket. If objects use SSE-KMS, also allow cloudfront.amazonaws.com to call kms:Decrypt in the key policy with the same SourceArn condition.

OAI bucket policy (legacy, for reading old setups)

{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
 "Principal":{"AWS":"arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2QWRUHAPOMQZL"},
 "Action":"s3:GetObject","Resource":"arn:aws:s3:::course-videos/*"}]}

Migrating: create an OAC, add the OAC statement to the bucket policy, switch the origin to the OAC, test, then remove the OAI statement.

3. Signed URLs and signed cookies

Why do we need this?

OAC hides the bucket, but the CloudFront URL itself is still open. For paid or private content each viewer needs a personal, expiring permission.

What is it?

You mark a cache behavior as Restrict viewer access: Yes and attach a key group. Your app signs URLs or cookies with the matching private key. CloudFront checks the signature with the public key and the expiry. No valid signature = 403.

4. Key groups

• Create an RSA 2048 key pair yourself: openssl genrsa -out private_key.pem 2048 and openssl rsa -pubout -in private_key.pem -out public_key.pem.
• Upload only the public key to CloudFront › Key management › Public keys. You get an ID like K2JCJMDEHXQW5F.
• Put it in a key group and attach the group to the behavior. Rotation: add a new key to the group, switch the app, remove the old key.
• Keep the private key in AWS Secrets Manager or SSM Parameter Store, never in Git. Key groups replace the old root-account "CloudFront key pairs".
• Expiry: short for video (5 to 60 minutes). A signed URL is checked when the request starts, so a long download that began before expiry can finish.

5. Geo restriction and AWS WAF

• Geo restriction (Security tab): an allow list or block list of countries. Blocked viewers get 403. Why: licensing ("India only") or legal rules. CloudFront uses a GeoIP database, so it is about 99.8% accurate, and VPNs can get around it.
• AWS WAF: a web ACL attached to the distribution. Start with AWS managed rule groups (Core rule set, Known bad inputs, SQL database) and a rate-based rule such as 2,000 requests per 5 minutes per IP. Why: blocks SQL injection, bad bots and floods at the edge, before your origin.
• AWS Shield Standard protects every distribution from common network DDoS attacks at no extra cost.

6. Signing code in three languages

// Node.js  -  npm i @aws-sdk/cloudfront-signer
const { getSignedUrl } = require('@aws-sdk/cloudfront-signer');
const fs = require('fs');
const url = getSignedUrl({
  url: 'https://dXXXX.cloudfront.net/private/intro.mp4',
  keyPairId: 'K2JCJMDEHXQW5F',                     // public key ID
  privateKey: fs.readFileSync('private_key.pem', 'utf8'),
  dateLessThan: new Date(Date.now() + 5 * 60 * 1000).toISOString()  // 5 minutes
});
console.log(url);

# Python  -  pip install botocore cryptography
import datetime
from botocore.signers import CloudFrontSigner
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

KEY = serialization.load_pem_private_key(open("private_key.pem", "rb").read(), password=None)
def rsa_signer(message):
    return KEY.sign(message, padding.PKCS1v15(), hashes.SHA1())  # CloudFront uses RSA-SHA1

signer = CloudFrontSigner("K2JCJMDEHXQW5F", rsa_signer)
expires = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(minutes=5)
print(signer.generate_presigned_url("https://dXXXX.cloudfront.net/private/intro.mp4", date_less_than=expires))

<?php // PHP  -  composer require aws/aws-sdk-php
require 'vendor/autoload.php';
$cf = new Aws\CloudFront\CloudFrontClient(['region' => 'us-east-1', 'version' => '2020-05-31']);
echo $cf->getSignedUrl([
    'url'         => 'https://dXXXX.cloudfront.net/private/intro.mp4',
    'expires'     => time() + 300,
    'private_key' => __DIR__ . '/private_key.pem',
    'key_pair_id' => 'K2JCJMDEHXQW5F',
]);

Signed cookies in Node use getSignedCookies({url, keyPairId, privateKey, policy}) with a custom policy whose Resource is https://dXXXX.cloudfront.net/course/42/*; set the three returned cookies with Domain, Secure and HttpOnly.

7. Lab: a private video with a 5-minute signed URL

How to do it (step by step)

1. Bucket yourname-cf-secure (private). Upload a short MP4: aws s3 cp intro.mp4 s3://yourname-cf-secure/private/intro.mp4. Also upload free/preview.mp4.
2. In CloudShell: openssl genrsa -out private_key.pem 2048 && openssl rsa -pubout -in private_key.pem -out public_key.pem.
3. CloudFront › Public keys › Create: name lab-key, paste public_key.pem. Copy the ID.
4. Key groups › Create: name lab-kg, select lab-key.
5. Create distribution: origin = the bucket REST endpoint with a new OAC, default behavior CachingOptimized, Redirect HTTP to HTTPS. Apply the bucket policy CloudFront shows.
6. Behaviors › Create: path /private/*, same origin, Restrict viewer access: Yes, Trusted key groups = lab-kg. Save and wait for deploy.
7. Free file: curl -sI https://dXXXX.cloudfront.net/free/preview.mp4 | head -1. Expected: HTTP/2 200.
8. Private file, no signature: curl -sI https://dXXXX.cloudfront.net/private/intro.mp4 | head -1. Expected: HTTP/2 403 (MissingKey).
9. Sign it with the Node, Python or PHP code above (your domain and key ID). curl -sI "SIGNED_URL" | head -1. Expected: 200. Open it in a browser: the video plays.
10. Tamper test: change one letter of Signature. Expected: 403 (Access denied).
11. Wait 6 minutes and run the original signed URL again. Expected: 403 with "Access denied" because Expires has passed.
12. Bypass test: curl -sI https://yourname-cf-secure.s3.ap-south-1.amazonaws.com/private/intro.mp4 | head -1. Expected: 403 (OAC keeps the bucket private).
13. Optional geo test: Security › CloudFront geographic restrictions › Block list › India. After deploy, the free file returns 403 from an Indian IP. Remove the block afterwards.

Cleanup

1. Disable and delete the distribution. Then delete key group lab-kg, public key lab-key and the OAC (in that order; in-use items cannot be deleted).
2. aws s3 rb s3://yourname-cf-secure --force; shred -u private_key.pem.

8. Interview questions

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.