I'm working on a PoC for restricting access to certain files within a web application. Basically, one user should have access to all files in S3 and another should only have access to public files (which are also available to non-logged-in users).

I set up an S3 bucket with a private-files folder and a public-files folder, set up a bucket policy to restrict access to the public files to one cloudfront arn, and access to the private files to another cloudfront arn. Testing this without file restriction enabled on either cloudfront distribution shows that it works as expected.

Then I restricted access to files via the private cloudfront distribution, limited the signers to "self," and generated the cloudfront keypair under my security credentials.

I'm using this script basically out of the box, with minor edits (like spacing and removing some casting) in order to get the interpreter to work. It generates cookies no problem.

When I try to access a private file via the cloudfront url, I get the following message:

<?xml version="1.0" encoding="UTF-8"?>
    <Message>Missing Key-Pair-Id query parameter or cookie value</Message>

Postman says it comes with a 403 forbidden status. When I add CloudFront-Signature, CloudFront-Key-Pair-Id,CloudFront-Policy to the cookies in postman, I get back

<?xml version="1.0" encoding="UTF-8"?>
    <Message>Unknown Key</Message>

again with a 403. The CloudFront-Key-Pair-Id seems to be the cookie that makes this happen, as the other two alone only return a missing key and this one by itself returns the invalid key message.

Is there anything I need to send besides these cookies? Are these the expected error messages given the setup I've described above, or am I missing some data I need to send, or is there possibly something else wrong?

2 Answers 2


Missing key and invalid key refers to the AWS cloudfront key pair id, not to the S3 object key. If you don't send that value you will get a missing key response. If you send that value and its wrong you will get invalid key.

Log in to your aws account, click your account name in the top right and choose my security credentials. Expand the cloudfront access keys section and copy the keypair id from there.


I was able to resolve the issue using the following steps:

  1. Go to the cloudfront distribution
  2. Click on the Behaviors tab
  3. Select the checkbox and click on Edit
  4. Select Trusted Signer in the Trusted Key Groups or Trusted Signer radio button
  5. Click Save


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .