I'm trying to integrate signed cookies for a CloudFront distribution that's fed off of an S3 bucket but getting access denied error messages:

    <Message>Access Denied</Message>
    <RequestId>BLAH BLAH</RequestId>
    <HostId>BLAH BLAH</HostId>

What baffles me is that some files do seem to work consistently while others in the very same directory my custom policy allows fails using the same signed cookies.

For example: I have a file at /projects/index.html which works and a file at /projects/src/Runtime.js which doesn't despite using a custom policy that clearly allows both of them by having a wildcard in the resource: http://test.mydomain.com/projects/*

Both files are set to private on S3, the only difference I can think of between how these two files are requested is that the /projects/src/Runtime.js file is requested with a referrer test.mydomain.com and not mydomain.com which is what served the first /projects/index.html request.

I know the cookies are being set properly on both requests, and that the custom policy and signature for them is valid because when I mess around with them and give them wrong values I do get a different error message.

Anyways! My configuration is as follows:
CloudFront settings: i.imgur.com/DMcUeDY.png (Serverfault link limitation, bah)
I have an alternative host name that's a subdomain of the site that's serving the file (for example test.mydomain.com). Its not a real CNAME entry and I dont have a cert for it - I'm referencing CloudFront using that name via local /etc/hosts entry.

CloudFront Origin settings: i.imgur.com/ereGJ42.png (Serverfault link limitation, meh)
The origin is straightforward - Referencing the root of my s3 bucket, and I don't restrict the bucket because it also contains files that I want to remain publicly available.

I modified the deafult behaviour: i.imgur.com/5N2RlxM.png (Serverfault link limitation, uhh)
Basically turned on the Restrict Viewer Access. The trusted signers are the root account which is also the owner of the s3 bucket.

The rest of the CloudFront options were left untouched. I have a CloudFront keypair generated by amazon and i'm using it with the snippets amazon provided for PHP (using openssl_sign) to sign a custom policy giving access to an entire directory.

I can't really validate where the problem is thanks to the really vague "Access Denied" error message but I'm pretty sure its not in the way I sign the cookies. I've tried using wrong values and got different errors like "Malformed Signature" or "Malformed Policy" so I'm assuming my signing checks out. Also, as I mentioned some files do work.

I've been stuck on this for a few days now, any help would be greatly appreciated!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.