aws cloudfront sign-cookies

Generate CloudFront signed cookies for a given resource. AWS CLI reference

2 examples Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

Example 1: To generate CloudFront signed cookies

The following sign-cookies example generates signed cookies that grant access to every object in a CloudFront distribution. To generate signed cookies, you need the key pair ID (called the Access Key ID in the AWS Management Console) and the private key of the trusted signer's CloudFront key pair. Because the resource contains a wildcard, a custom policy is used.

aws cloudfront sign-cookies --resource "https://d111111abcdef8.cloudfront.net/*" --key-pair-id APKAEIBAERJR2EXAMPLE --private-key file://cf-signer-priv-key.pem --date-less-than 2020-01-01 --hash-algorithm SHA256

Identify

Contents of cf-signer-priv-key.pem:

-----BEGIN RSA PRIVATE KEY-----
EXAMPLEPRIVATEKEYMIIEowIBAAKCAQEAxPMbCA2Ks0lnd7IR+3pwwd3H/7jPGwj8
bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJEXAMPLEKEY...
-----END RSA PRIVATE KEY-----

Its output

{
    "CloudFront-Policy": "eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kMTExMTExYWJjZGVmOC5jbG91ZGZyb250Lm5ldC8qIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNTc3ODM2ODAwfX19XX0_",
    "CloudFront-Signature": "Uu8FSzfyZ1pUJfnPTfpZpXoR3cHtu6Vk41gOodDpfCGmY4j~TBvOMBUsXzrcBjAqRuVV9b0Aa1HBpHeY-TR3G3Jbb2Yn2cxNSlAfC4tIYwWOkwypCZl4csuHdFC8XaN0yA0G8GRHDsxNPHKY6lq3ypbnJcXDSzzCixTAgJpOO7M_",
    "CloudFront-Key-Pair-Id": "APKAEIBAERJR2EXAMPLE",
    "CloudFront-Hash-Algorithm": "SHA256"
}

Set each cookie in the response to the viewer, adding the cookie attributes (such as Domain, Path, Secure and HttpOnly) that your application needs.

For more information, see Use signed cookies in the Amazon CloudFront Developer Guide.

Example 2: To extract a single cookie value

The following sign-cookies example generates signed cookies and returns only the value of the CloudFront-Signature cookie. The set of cookies depends on the policy type and hash algorithm, so the columns of --output text vary between invocations. Use --query to select a cookie by name.

aws cloudfront sign-cookies --resource "https://d111111abcdef8.cloudfront.net/*" --key-pair-id APKAEIBAERJR2EXAMPLE --private-key file://cf-signer-priv-key.pem --date-less-than 2020-01-01 --hash-algorithm SHA256 --query '"CloudFront-Signature"' --output text

Identify

--queryA JMESPath query to use in filtering the response data.

--outputThe formatting style for command output.

Its output

Uu8FSzfyZ1pUJfnPTfpZpXoR3cHtu6Vk41gOodDpfCGmY4j~TBvOMBUsXzrcBjAqRuVV9b0Aa1HBpHeY-TR3G3Jbb2Yn2cxNSlAfC4tIYwWOkwypCZl4csuHdFC8XaN0yA0G8GRHDsxNPHKY6lq3ypbnJcXDSzzCixTAgJpOO7M_

For more information, see Use signed cookies in the Amazon CloudFront Developer Guide.