# @aws-sdk/cloudfront-signer

> This package provides functions to generate signed urls and cookies for accessing private content on CloudFront based on a CloudFront trusted key group key pair.

Latest version **3.1138.0** (published 2026-09-22) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @aws-sdk/cloudfront-signer
pnpm add @aws-sdk/cloudfront-signer
yarn add @aws-sdk/cloudfront-signer
bun add @aws-sdk/cloudfront-signer
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 3.1138.0 |
| Published | 2026-09-22 |
| First published | 2022-05-12 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=20.0.0 |
| Dependencies | 2 |
| Unpacked size | 43.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 3669 |
| Author | AWS SDK for JavaScript Team |
| Maintainers | amzn-oss, aws-sdk-bot |

## Links

- npm: https://www.npmjs.com/package/@aws-sdk/cloudfront-signer
- Repository: https://github.com/aws/aws-sdk-js-v3
- Homepage: https://github.com/aws/aws-sdk-js-v3/tree/main/packages/cloudfront-signer
- Issues: https://github.com/aws/aws-sdk-js-v3/issues
- npm.io page: https://npm.io/package/@aws-sdk/cloudfront-signer

## Dependencies (2)

- [tslib](https://npm.io/package/tslib.md) ^2.6.2
- [@smithy/core](https://npm.io/package/@smithy/core.md) ^3.35.0

## Recent versions

- 3.1138.0 (latest) — 2026-09-22
- 3.1125.0 — 2026-09-02
- 3.1116.0 — 2026-08-21
- 3.1111.0 — 2026-08-14
- 3.1108.0 — 2026-08-11
- 3.1098.0 — 2026-07-29
- 3.1095.0 — 2026-07-24
- 3.1088.0 — 2026-07-15
- 3.1087.0 — 2026-07-14
- 3.1082.0 — 2026-07-08
- 3.1078.0 — 2026-07-01
- 3.1077.0 — 2026-06-30
- 3.1076.0 — 2026-06-29
- 3.1074.0 — 2026-06-22
- 3.1069.0 — 2026-06-15
- … 149 more at https://npm.io/package/@aws-sdk/cloudfront-signer/versions

## README

# @aws-sdk/cloudfront-signer

This package provides functions to generate signed urls and cookies for accessing private content on CloudFront based on a CloudFront trusted key group key pair.

> Please note the process for creating a signed URL with Cloudfront is very different than the process for S3. For more information, please visit the documentation for [restricting CloudFront content with signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html).

### Sign a URL

JavaScript Example:

```javascript
import { getSignedUrl } from "@aws-sdk/cloudfront-signer"; // ESM
// const { getSignedUrl } = require("@aws-sdk/cloudfront-signer"); // CJS

const cloudfrontDistributionDomain = "https://d111111abcdef8.cloudfront.net";
const s3ObjectKey = "private-content/private.jpeg";
const url = `${cloudfrontDistributionDomain}/${s3ObjectKey}`;
const privateKey = "CONTENTS-OF-PRIVATE-KEY";
const keyPairId = "PUBLIC-KEY-ID-OF-CLOUDFRONT-KEY-PAIR";
const dateLessThan = "2022-01-01"; // any Date constructor compatible

const signedUrl = getSignedUrl({
  url,
  keyPairId,
  dateLessThan,
  privateKey,
});
```

### Sign a URL with a Policy

```javascript
import { getSignedUrl } from "@aws-sdk/cloudfront-signer"; // ESM
// const { getSignedUrl } = require("@aws-sdk/cloudfront-signer"); // CJS

const cloudfrontDistributionDomain = "https://d111111abcdef8.cloudfront.net";
const s3ObjectKey = "private-content/private.jpeg";
const url = `${cloudfrontDistributionDomain}/${s3ObjectKey}`;
const privateKey = "CONTENTS-OF-PRIVATE-KEY";
const keyPairId = "PUBLIC-KEY-ID-OF-CLOUDFRONT-KEY-PAIR";
const dateLessThan = "2022-01-01";

const policy = {
  Statement: [
    {
      Resource: url,
      Condition: {
        DateLessThan: {
          "AWS:EpochTime": new Date(dateLessThan).getTime() / 1000, // time in seconds
        },
      },
    },
  ],
};

const policyString = JSON.stringify(policy);

const signedUrl = getSignedUrl({
  keyPairId,
  privateKey,
  policy: policyString,
  // url is automatically extracted from the policy, however you could still overwrite it if needed
});
```

### Get signed cookies for a resource

```javascript
import { getSignedCookies } from "@aws-sdk/cloudfront-signer"; // ESM
// const { getSignedCookies } = require("@aws-sdk/cloudfront-signer"); // CJS

const cloudfrontDistributionDomain = "https://d111111abcdef8.cloudfront.net";
const s3ObjectKey = "private-content/private.jpeg";
const url = `${cloudfrontDistributionDomain}/${s3ObjectKey}`;
const privateKey = "CONTENTS-OF-PRIVATE-KEY";
const keyPairId = "PUBLIC-KEY-ID-OF-CLOUDFRONT-KEY-PAIR";
const dateLessThan = "2022-01-01";

const cookies = getSignedCookies({
  url,
  keyPairId,
  dateLessThan,
  privateKey,
});
```

### Get signed cookies with a Policy

```javascript
import { getSignedCookies } from "@aws-sdk/cloudfront-signer"; // ESM
// const { getSignedCookies } = require("@aws-sdk/cloudfront-signer"); // CJS

const cloudfrontDistributionDomain = "https://d111111abcdef8.cloudfront.net";
const s3ObjectKey = "private-content/private.jpeg";
const url = `${cloudfrontDistributionDomain}/${s3ObjectKey}`;
const privateKey = "CONTENTS-OF-PRIVATE-KEY";
const keyPairId = "PUBLIC-KEY-ID-OF-CLOUDFRONT-KEY-PAIR";
const dateLessThan = "2022-01-01";

const policy = {
  Statement: [
    {
      Resource: url,
      Condition: {
        DateLessThan: {
          "AWS:EpochTime": new Date(dateLessThan).getTime() / 1000, // time in seconds
        },
      },
    },
  ],
};

const policyString = JSON.stringify(policy);

const cookies = getSignedCookies({
  keyPairId,
  privateKey,
  policy: policyString,
});
```

---
_Source: https://npm.io/package/@aws-sdk/cloudfront-signer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._