# SigningBehavior

Options for which requests CloudFront signs.

The recommended setting is `always`.

- Source: [`aws-cloudfront/lib/origin-access-control.ts`](https://github.com/aws/aws-cdk/blob/v2.277.0/packages/aws-cdk-lib/aws-cloudfront/lib/origin-access-control.ts#L113)
- Type last changed: v2.274.0 · 20 Oct 2026

## Members

| Member | Description |
| --- | --- |
| `ALWAYS` | Sign all origin requests, overwriting the Authorization header from the viewer request if one exists. |
| `ALWAYS_AMZ_AUTH` | Sign all origin requests, and pass the Authorization header from the viewer request to the origin unchanged. |
| `NEVER` | Do not sign any origin requests. |
| `NO_OVERRIDE` | Sign origin requests only if the viewer request doesn't contain the Authorization header. |

## Referenced by

- [`Signing`](/v2/docs/aws-cdk-lib.aws_cloudfront.Signing).behavior