aws-cloudfront-sign

import { getSignedUrl, getSignedCookies } from 'aws-cloudfront-sign'; import * as path from 'path'; import * as fs from 'fs'; // Replace with your actual CloudFront distribution URL const cloudfrontUrl = 'https://d1234.cloudfront.net/path/to/my/asset.jpg'; // Your CloudFront key pair ID const keypairId = process.env.CLOUDFRONT_KEY_PAIR_ID ?? 'APKAEIBAZAZAZAZAZAZA'; // Path to your private key file or the key content as a string const privateKeyPath = process.env.CLOUDFRONT_PRIVATE_KEY_PATH ?? path.resolve(__dirname, 'pk-APKAEIBAZAZAZAZAZAZA.pem'); let privateKeyString: string; try { privateKeyString = fs.readFileSync(privateKeyPath, 'utf8'); } catch (error) { console.error(`Error reading private key file at ${privateKeyPath}:`, error); // Fallback for demonstration if file not found, but this should be valid in a real app privateKeyString = process.env.CLOUDFRONT_PRIVATE_KEY_STRING ?? '-----BEGIN RSA PRIVATE KEY-----\n' + 'MIIJKAIBAAKCAgEAwGPMqEvxPYQIffDimM9t3A7Z4aBFAUvLiITzmHRc4UPwryJp\n' + 'EVi3C0sQQKBHlq2IOwrmqNiAk31/uh4...[truncated]...QIDAQABAoIBAB2zE\n' + '-----END RSA PRIVATE KEY-----'; } // Options for signing, including an expiration time (e.g., 1 hour from now) const oneHourFromNow = Date.now() + 60 * 60 * 1000; // 1 hour in milliseconds const options = { keypairId: keypairId, privateKeyString: privateKeyString, expireTime: oneHourFromNow, // ipRange: '192.168.1.0/24' // Optional: restrict access to a specific IP range }; async function signCloudFrontResources() { try { // 1. Get a signed URL const signedUrl = getSignedUrl(cloudfrontUrl, options); console.log('Generated Signed URL:', signedUrl); // 2. Get signed cookies const signedCookies = getSignedCookies(cloudfrontUrl, options); console.log('Generated Signed Cookies:', signedCookies); // Example of how you might set cookies in a response (e.g., Express.js) // res.cookie('CloudFront-Policy', signedCookies['CloudFront-Policy'], { httpOnly: true, secure: true }); // res.cookie('CloudFront-Signature', signedCookies['CloudFront-Signature'], { httpOnly: true, secure: true }); // res.cookie('CloudFront-Key-Pair-Id', signedCookies['CloudFront-Key-Pair-Id'], { httpOnly: true, secure: true }); } catch (error) { console.error('Error signing CloudFront resources:', error); } } signCloudFrontResources();