使用AWS Java SDK拒绝访问由链接到私有S3存储桶的Amazon CloudFront的安全签名URL提供的图像

Question

I have used AWS Java SDK to create signed URLs and trying to serve images through cloud front linked to private S3 bucket- Steps taken-

1. Create private S3 bucket.
2. Link that S3 bucket to cloudFront through which only secure signed Urls can be accessed.
3. Created CloudFront key from CloudFrontConsole.
4. Convert ket to .der to support Java.
5. Upload Image to Private S3 bucket using AWS Java SDK- Working Fine

6. Use code below to create URL by signing through .der key obtained.

   { String distributionDomain= "distributionDomain";

    String keyPairId="keyPairId"; String s3ObjectKey=picName; Date dateLessThan = DateUtils.parseISO8601Date("2014-01-12T21:20:00.000Z"); InputStream inputStream = ImageServiceImpl.class.getResourceAsStream("/cloudFront.der"); byte[] privateKeyBytes=IOUtils.toByteArray(inputStream); PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes); KeyFactory keyFactory; PrivateKey myPrivKey=null; try { keyFactory = KeyFactory.getInstance("RSA"); myPrivKey = keyFactory.generatePrivate(keySpec); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } System.out.println(myPrivKey); String domainUrl= "https://" + distributionDomain + "/" + s3ObjectKey; String url1 = CloudFrontUrlSigner.getSignedURLWithCannedPolicy(domainUrl, keyPairId, myPrivKey, dateLessThan); System.out.println(url1); 

   }

When I hit URL secure signed URL obtained I am getting access denied, not sure what I am missing here. Please also let me know if any other info is required.

Answer 1

I followed this guide ( https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html ) and like yourself I was using Java so I had to convert the CloudFront key to a der format (which Java can read). I did this using the following openssl command: -

openssl pkcs8 -topk8 -nocrypt -in MyKey.pem -inform PEM -out MyKey.der -outform DER

Once you have the key converted you can run the following: -

public class AwsSignUrlCreator {

    public static void main(String[] args) throws InvalidKeySpecException, IOException {

        // The DNS name of your CloudFront distribution, or a registered alias
        String distributionDomainName = "xxxx.cloudfront.net";

        // the private key you created in the AWS Management Console 
        File cloudFrontPrivateKeyFile = new File ("C:/mykeys/MyKey.der");

        // The unique ID assigned to your CloudFront key pair in the console
        String cloudFrontKeyPairId = "xxxx";
        Date expirationDate = new Date(System.currentTimeMillis() + 60 * 1000);
        String s3ObjectKey = "my-file.txt";
        String signedUrl = CloudFrontUrlSigner.getSignedURLWithCannedPolicy(
            Protocol.https,
            distributionDomainName,
            cloudFrontPrivateKeyFile,
            s3ObjectKey,
            cloudFrontKeyPairId,
            expirationDate);

        System.out.println(signedUrl);
    }

}