I'm working on a PoC for restricting access to certain files within a web application. Basically, one user should have access to all files in S3 and another should only have access to public files (which are also available to non-logged-in users).
I set up an S3 bucket with a private-files
folder and a public-files
folder, set up a bucket policy to restrict access to the public files to one cloudfront arn, and access to the private files to another cloudfront arn. Testing this without file restriction enabled on either cloudfront distribution shows that it works as expected.
Then I restricted access to files via the private cloudfront distribution, limited the signers to "self," and generated the cloudfront keypair under my security credentials.
I'm using this script basically out of the box, with minor edits (like spacing and removing some casting) in order to get the interpreter to work. It generates cookies no problem.
When I try to access a private file via the cloudfront url, I get the following message:
<?xml version="1.0" encoding="UTF-8"?>
<Error>
<Code>MissingKey</Code>
<Message>Missing Key-Pair-Id query parameter or cookie value</Message>
</Error>
Postman says it comes with a 403 forbidden status. When I add CloudFront-Signature, CloudFront-Key-Pair-Id,CloudFront-Policy to the cookies in postman, I get back
<?xml version="1.0" encoding="UTF-8"?>
<Error>
<Code>InvalidKey</Code>
<Message>Unknown Key</Message>
</Error>
again with a 403. The CloudFront-Key-Pair-Id seems to be the cookie that makes this happen, as the other two alone only return a missing key and this one by itself returns the invalid key message.
Is there anything I need to send besides these cookies? Are these the expected error messages given the setup I've described above, or am I missing some data I need to send, or is there possibly something else wrong?