Signed URLs, Signed Cookies, and Geo-Restriction

By default, CloudFront serves content to any viewer who knows the URL. For premium or private content—video courses, paid software downloads, member-only resources—you need to restrict access so only authorised users can retrieve it.

CloudFront provides two mechanisms for authorised access: Signed URLs (one URL grants access to one specific object) and Signed Cookies (a set of cookies grants access to multiple objects matching a path pattern). Both use cryptographic signatures generated with an RSA key pair.

A Signed URL is a CloudFront URL that includes a cryptographic signature encoding an expiry time and optionally an IP address restriction. The URL is only valid until its expiry and only from the allowed IP (if specified). After expiry, CloudFront returns a 403 Forbidden.

Signed URLs are best for: granting a single user access to one specific file (e.g., a generated PDF report), time-limited download links, or when the client cannot set cookies (e.g., mobile apps or RTMP streaming).

Signed Cookies work similarly to Signed URLs but grant access to multiple files without changing each URL. After successful authentication, your server generates three cookies (CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id) and sets them in the browser response. Subsequent CloudFront requests from that browser include the cookies, granting access to all matching content.

Signed Cookies are best for: granting logged-in users access to an entire premium section (e.g., all videos in /members/*), or when you cannot control the URL format of each individual resource.

To generate CloudFront signatures, you need a CloudFront key pair. The modern approach uses Trusted Key Groups: create an RSA key pair, upload the public key to CloudFront, add it to a key group, then associate the key group with the cache behavior that requires signed access.

The private key is stored securely (e.g., in Secrets Manager) on your signing server. When a user authenticates, the server uses the private key to sign a URL or cookie policy. CloudFront validates signatures using the corresponding public key in the trusted key group.

Signed URLs can use one of two policy types:

• Canned policy: simplest form—specifies only a resource URL and an expiry time. The signature is compact and easy to generate.
• Custom policy: more flexible—specifies resource URL with optional wildcards (https://d123.cloudfront.net/videos/*), an optional start time (not-before), and optionally an IP address restriction. The policy JSON is Base64-encoded in the URL.

Use canned policies for simple single-file links; use custom policies when you need wildcard resource matching or IP-based restrictions.

Geo-restriction (also called geographic restrictions) blocks or allows CloudFront to serve content based on the country of the viewer. CloudFront determines the viewer's country from their IP address using a third-party geolocation database.

You configure geo-restriction per distribution as either an allowlist (only listed countries can access content) or a blocklist (listed countries are blocked). Users in restricted countries receive an HTTP 403 response. Geo-restriction is a blunt tool—it applies to the entire distribution, not individual paths.

CloudFront geo-restriction and Route 53 geolocation routing both use geography, but serve different purposes:

• CloudFront geo-restriction: blocks or allows edge serving of content at the CDN layer—returns 403 to blocked countries; applies per distribution
• Route 53 geolocation: routes DNS queries to different endpoints (different servers or pages) based on geography—does not block access but redirects to different content or infrastructure

Use CloudFront geo-restriction for access control (blocking entire countries). Use Route 53 geolocation for routing users to regionally appropriate content or infrastructure.

A complete private content delivery architecture:

1. S3 bucket is private (no public access)
2. CloudFront uses OAC so only the distribution can read from S3
3. Cache behavior for private content requires signed URLs or cookies (Trusted Key Group associated)
4. Your application server authenticates users and issues signed URLs/cookies
5. Users access content only via time-limited signed CloudFront URLs

Even if a user guesses or shares the S3 URL, access is blocked. Even if they share the CloudFront URL, it expires after the configured time. This layered approach provides defence-in-depth for digital content.

Field-level encryption is an advanced CloudFront feature that allows sensitive data fields in HTTP POST requests to be encrypted at the edge before forwarding to the origin. Even if the origin server is compromised, the encrypted fields (e.g., credit card numbers, SSNs) remain unreadable without the corresponding private key.

CloudFront encrypts specified fields using a public key at the edge. Only the intended backend service with the matching private key can decrypt the data. Field-level encryption adds a layer of protection within an already-TLS-secured pipeline.

For dynamic applications that need fine-grained access control beyond country-level blocking, a common pattern is token-based access using Lambda@Edge:

1. User authenticates with Cognito or your auth service and receives a JWT
2. User includes the JWT as a query parameter or cookie on CloudFront requests
3. Lambda@Edge Viewer-Request function validates the JWT signature and claims
4. If valid, Lambda@Edge forwards the request to the origin; if invalid, it returns 401

This gives per-user, per-resource, fine-grained access control entirely at the CloudFront edge without reaching the origin for unauthorised requests.

Exam scenario patterns for Signed URLs/Cookies and geo-restriction:

• 'Time-limited download link for a purchased file' → Signed URL with expiry
• 'Logged-in premium users access all videos in /premium/*' → Signed Cookies with wildcard policy
• 'Block access for users in specific countries due to licensing' → CloudFront geo-restriction blocklist
• 'Serve different content to different countries' → Route 53 geolocation + multiple distributions or origins
• 'Protect credit card fields even from origin admins' → Field-level encryption

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: Signed URLs restrict access to individual files with an expiry time and optional IP restriction, Signed Cookies grant access to multiple files matching a path pattern in a single authenticated session, and geo-restriction blocks or allows entire countries at the CloudFront distribution level. Next up we explore CloudFront with WAF and Lambda@Edge.