Back to All Checks
Medium CloudFront

CloudFront distributions should use trusted key groups for signed URLs and cookies

Description

Flags Amazon CloudFront distributions that authenticate signed URLs or signed cookies using legacy trusted signers. Trusted signers rely on root account access keys; trusted key groups use IAM-managed key pairs and are the recommended replacement.

Remediation

Replace trusted signers with trusted key groups on every cache behavior that uses signed URLs or signed cookies.

Steps

  1. Open the CloudFront console and select the distribution.
  2. For each cache behavior using restricted viewer access, choose Edit.
  3. Under Restrict viewer access, switch from Trusted signers to Trusted key groups.
  4. Select or create a key group containing your CloudFront key pairs.
  5. Save the changes.
Start Your Free Security Check