feat(cloudfront): add sigv4a signing protocol for origin access control - #38629
Open
piotrekwitkowski wants to merge 1 commit into
Open
feat(cloudfront): add sigv4a signing protocol for origin access control#38629piotrekwitkowski wants to merge 1 commit into
piotrekwitkowski wants to merge 1 commit into
Conversation
piotrekwitkowski
temporarily deployed
to
automation
August 21, 2026 19:10 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
piotrekwitkowski
temporarily deployed
to
automation
August 21, 2026 19:10 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
github-actions
Bot
added
beginning-contributor
piotrekwitkowski
temporarily deployed
to
automation
August 21, 2026 19:10 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
piotrekwitkowski
marked this pull request as ready for review
August 27, 2026 08:35
piotrekwitkowski
changed the title
This was referenced Aug 27, 2026
Adds SigningProtocol.SIGV4A and Signing.SIGV4A_ALWAYS, the combination documented for Amazon S3 Multi-Region Access Point origins. Other signing behaviors remain available through the public Signing constructor. Part of aws#38627.
piotrekwitkowski
force-pushed
the
feat/cloudfront-oac-sigv4a
branch
from
August 29, 2026 16:18
be22180 to
b27fe3e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Part of #38627.
Reason for this change
CloudFront added
sigv4aas an origin access control signing protocol, which is needed to sign requests to Amazon S3 Multi-Region Access Point origins. CDK'sSigningProtocolenum only hassigv4, so the configuration cannot be expressed.Description of changes
SigningProtocol.SIGV4A.Signing.SIGV4A_ALWAYS, the combination documented for S3 Multi-Region Access Point origins. Other signing behaviors remain available through the publicSigningconstructor.aws-cloudfront-originsREADME.S3MrapOriginis intentionally left out of this PR; see #38627.Describe any new or updated permissions being added
None.
Description of how you validated changes
Unit tests for both the new static and the
Signingconstructor withsigv4a. Fullaws-cloudfrontandaws-cloudfront-originssuites pass (455 tests), and Rosetta compiles the new README example.The integration test has been deployed and passed in
us-east-1:It creates a real
AWS::CloudFront::OriginAccessControlwithSigningProtocol: sigv4aand asserts viagetOriginAccessControlConfigthat the API returnssigv4a/always/s3. The committed snapshot is unchanged.The integration snapshot contains non-failing rule
F3031because@aws/cloudformation-validate1.7.0 bundles an older offline schema that permits onlysigv4. The live CloudFormation schema now permitssigv4a; the report conclusion issuccess, and the deployment passed.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license