CloudFront distributions should use trusted key groups for signed URLs and cookies
Flags Amazon CloudFront distributions that authenticate signed URLs or signed cookies using legacy trusted signers, and those with no signed URL or signed cookie authentication configured at all. Trusted signers rely on root account access keys; trusted key groups use CloudFront-managed public keys and are the recommended replacement.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Point every cache behavior's viewer restriction at a CloudFront key group. The finding means one of two things and the evidence line says which. A behavior still on trusted signers migrates: upload the public key to CloudFront, put it in a key group, and point the behavior at that group. The same private key goes on signing, so URLs already issued keep working. A behavior with no viewer restriction at all has nothing to migrate, and if the distribution is public on purpose there is nothing to fix here: adding a key group would put every ordinary viewer behind a signed URL and take the site offline.
In the console
CloudFront → Distributions → the distribution → Behaviors → the behavior → Restrict viewer access → Trusted key groups
See which of your accounts this check is failing on.
Book a demo