How to enable expiration when signing a cloudfront cdn?

[slavoroi]

How do I expire a cdn link in your example?

const secret = '<YOUR_SECRET_VALUE_IN_SECRETS_MANAGER>';
const path = '/<YOUR_PATH>'; // Add the first '/' to path.
const signature = crypto.createHmac('sha256', secret).update(path).digest('hex');
https://<distributionName>.cloudfront.net/<YOUR_PATH>?signature=<YOUR_SIGNATURE>

When using Amzaon's aws-sdk, this is how we sign cloudfront cdn's.

import { CloudFront } from 'aws-sdk';
...
const cdnSigner = new CloudFront.Signer(awsConfig?.cloudFront?.distributionId,
 awsConfig.awsCloudfrontSignerSecretAccessKey);
...
return cdnSigner.getSignedUrl({
   url: `${awsConfig.cloudFront?.domain}/${path}`,
   expires: DEFAULT_EXPIRATION_IN_MILLISECONDS
 });

Link to your docs.

[dougtoppin]

@slavoroi We will review this and provide an example

[slavoroi]

Keep us updated 💯

[dougtoppin]

We have not forgotten about this and will try to get to it soon.

[slavoroi]

Any updates? Can it be solved?

[simonkrol]

Hi @slavoroi,

I'm not sure I completely understand the question, the signature query parameter is used on the Lambda side of things to validate the request, it doesn't interact with CloudFront. If you've modified the created CloudFront distribution to restrict viewer access and require signed URLs, you would generate them in the same way that you mentioned in your question.

If you're looking to do things within the realms of the current solution, we don't currently support including an expiration query parameter but are evaluating adding it in a later release (#345).

We do currently allow the use of custom headers in base64 encoded requests, so if your only requirement is that CloudFront hits the backing lambda again after some period of time instead of caching the request, you can include the Cache-Control header as follows:

{
  "bucket": "YourBucket",
  "key": "ImageKey",
  "headers": {
    "Cache-Control": "max-age=someNumberOfSeconds,public"
  }
}

[slavoroi]

No, I need this image link to become invalid.
We are using (SO0023) - Serverless Image Handler. Version v6.2.4.

[simonkrol]

Hi @slavoroi, unfortunately that functionality is not currently available. You can keep an eye on #345 for when that feature is released.

[slavoroi]

I will! This would be amazing.