Signed CloudFront URL for a S3 bucket

Question

I'm trying to create a signed CloudFront URL for an object in a Frankfurt S3 bucket (using the python library boto). This used to work very well with eu-west-1 buckets, but now I'm getting the following error message:

<Error>
<Code>InvalidRequest</Code>
<Message>
The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.
</Message>
...

I understand that new S3 locations need API requests to be signed using AWS4-HMAC-SHA256, but I can't find anything in the AWS documentation how this changes the creation of signed CloudFront URLs

Edit:

To clarify, the following code produces a signed URL without raising an error ... The error occurs when opening the created URL in the browser afterwards

cf = cloudfront.CloudFrontConnection(aws_access_key_id=settings.AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=settings.AWS_SECRET_ACCESS_KEY)
distribution_summary = cf.get_all_distributions()[0]
distribution = distribution_summary.get_distribution()
return distribution.create_signed_url(url,
                                      settings.CLOUDFRONT_KEY_ID,
                                      int(time()) + expiration,
                                      private_key_file=settings.PRIVATE_KEY_FILE)

Answer 1

I found the issue, it was actually the cloud front distribution itself. It seems like moving the origin of the distribution which was already existing (for a long time) from an US bucket to an EU bucket didn't work out.

I created a new one with the same settings (except a new Origin Access Identity) and it worked without any issues.