(CloudFront): Support TrustedSigners & Key Groups

[stmasc]

In CloudFront in AWS Console I can create Public Keys, Key Groups and associate a Web Distributions Behavior with the trusted Key Group. I'd like to, at a minimum, create Key Groups and associate them with behaviors so I can serve private content out of Web Distributions created by CDK.

Use Case

I want to serve private content out of a Web Distribution created via CDK.

[stoyan-scava]

IMO it'd be best to add trustedKeyGroups to the Behavior interface of CloudFrontWebDistribution.

For the time being, I'm adding the trusted key group with a raw override of the CloudFormation template.

cfnDistribution.addOverride("Properties.DistributionConfig.DefaultCacheBehavior.TrustedKeyGroups", ["<my cloudfront key group id>"]);

[saksham]

Would be great to have this. I am resorting to L1 construct for creating my cloudfront distribution due to lack of this feature. My use case is exactly the same as that from @stmasc. Thanks!

[ilgarm]

Also interested in this feature

[NateBank]

IMO it'd be best to add trustedKeyGroups to the Behavior interface of CloudFrontWebDistribution.

For the time being, I'm adding the trusted key group with a raw override of the CloudFormation template.

cfnDistribution.addOverride("Properties.DistributionConfig.DefaultCacheBehavior.TrustedKeyGroups", ["<my cloudfront key group id>"]);

Isn't CloudFrontWebDistribution deprecated though? The CloudFront overview says Users are encouraged to use the newer Distribution instead, as it has a simpler interface and receives new features faster. I also am interested in how to set up trusted signers or whatever the new flavor of this is supposed to be using the correct construct.

[okonon]

I just ran into this myself. I have a need to have private only dist and serve content using signed urls. #12584

[okonon]

@njlynch i wonder if there are any updates regarding this request

[njlynch]

@okonon - No progress to report at the moment; I'm afraid I can't comment on when we'll be able to deliver this.

That being said, given the current 👍s, I've bumped this up to a p1 to note it's a top priority. I am also more than willing to work with anyone who's motivated to contribute to this (discuss design/review PRs).

I see this as (likely) 3 separate tasks/PRs, and can split them out for tracking purposes if anyone wants to tackle just one:

1. Creation of a PublicKey L2 construct. (Medium)
2. Creation of a KeyGroup L2 construct. (Small-to-Medium)
3. Integration of the KeyGroups with the Distribution and CloudFrontWebDistribution. (Medium+)

If anyone is interested in contributing, please let me know! Feel free to comment here or hit me up on the cdk.dev Slack channel to discuss design/implementation.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.