AWS CDK Reference

Appearance

v2.274.0

Signing Class ​

Options for how CloudFront signs requests.

Source
aws-cloudfront/lib/origin-access-control.ts
Type last changed
v2.274.0 · 20 Oct 2026

Example ​

ts
const myBucket = new s3.Bucket(this, 'myBucket');
const oac = new cloudfront.S3OriginAccessControl(this, 'MyOAC', {
  signing: cloudfront.Signing.SIGV4_NO_OVERRIDE
});
const s3Origin = origins.S3BucketOrigin.withOriginAccessControl(myBucket, {
    originAccessControl: oac
  }
)
new cloudfront.Distribution(this, 'myDist', {
  defaultBehavior: {
    origin: s3Origin
  },
});
python
my_bucket = s3.Bucket(self, "myBucket")
oac = cloudfront.S3OriginAccessControl(self, "MyOAC",
    signing=cloudfront.Signing.SIGV4_NO_OVERRIDE
)
s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
    origin_access_control=oac
)
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(
        origin=s3_origin
    )
)
java
Bucket myBucket = new Bucket(this, "myBucket");
S3OriginAccessControl oac = S3OriginAccessControl.Builder.create(this, "MyOAC")
        .signing(Signing.SIGV4_NO_OVERRIDE)
        .build();
IOrigin s3Origin = S3BucketOrigin.withOriginAccessControl(myBucket, S3BucketOriginWithOACProps.builder()
        .originAccessControl(oac)
        .build());
Distribution.Builder.create(this, "myDist")
        .defaultBehavior(BehaviorOptions.builder()
                .origin(s3Origin)
                .build())
        .build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
var myBucket = new Bucket(this, "myBucket");
var oac = new S3OriginAccessControl(this, "MyOAC", new S3OriginAccessControlProps {
    Signing = Signing.SIGV4_NO_OVERRIDE
});
var s3Origin = S3BucketOrigin.WithOriginAccessControl(myBucket, new S3BucketOriginWithOACProps {
    OriginAccessControl = oac
});
new Distribution(this, "myDist", new DistributionProps {
    DefaultBehavior = new BehaviorOptions {
        Origin = s3Origin
    }
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
myBucket := s3.NewBucket(this, jsii.String("myBucket"))
oac := cloudfront.NewS3OriginAccessControl(this, jsii.String("MyOAC"), &S3OriginAccessControlProps{
	Signing: cloudfront.Signing_SIGV4_NO_OVERRIDE(),
})
s3Origin := origins.S3BucketOrigin_WithOriginAccessControl(myBucket, &S3BucketOriginWithOACProps{
	OriginAccessControl: oac,
})
cloudfront.NewDistribution(this, jsii.String("myDist"), &DistributionProps{
	DefaultBehavior: &BehaviorOptions{
		Origin: s3Origin,
	},
})

Initializer ​

ts
new Signing(protocol: SigningProtocol, behavior: SigningBehavior)
python
Signing(protocol: SigningProtocol, behavior: SigningBehavior)
java
new Signing(SigningProtocol protocol, SigningBehavior behavior)
csharp
new Signing(SigningProtocol protocol, SigningBehavior behavior)
go
NewSigning(Protocol SigningProtocol, Behavior SigningBehavior)

Properties ​

behaviorSigningBehaviorbehaviorSigningBehaviorbehaviorSigningBehaviorBehaviorSigningBehaviorBehaviorSigningBehaviorrequired#
Which requests CloudFront signs.
NEVERSigningneverSigningNEVERSigningNEVERSigningNEVERSigningrequiredstatic#
Do not sign any origin requests.
protocolSigningProtocolprotocolSigningProtocolprotocolSigningProtocolProtocolSigningProtocolProtocolSigningProtocolrequired#
The signing protocol.
SIGV4_ALWAYSSigningsigv4_alwaysSigningSIGV4_ALWAYSSigningSIGV4_ALWAYSSigningSIGV4_ALWAYSSigningrequiredstatic#
Sign all origin requests using the AWS Signature Version 4 signing protocol.
SIGV4_ALWAYS_AMZ_AUTHSigningsigv4_always_amz_authSigningSIGV4_ALWAYS_AMZ_AUTHSigningSIGV4_ALWAYS_AMZ_AUTHSigningSIGV4_ALWAYS_AMZ_AUTHSigningrequiredstatic#
Sign all origin requests using the AWS Signature Version 4 signing protocol, and pass the viewer's Authorization header to the origin unchanged.

Use with regional AWS Lambda Web Function endpoints.

SIGV4_NO_OVERRIDESigningsigv4_no_overrideSigningSIGV4_NO_OVERRIDESigningSIGV4_NO_OVERRIDESigningSIGV4_NO_OVERRIDESigningrequiredstatic#
Sign only if the viewer request doesn't contain the Authorization header using the AWS Signature Version 4 signing protocol.
SIGV4A_ALWAYSSigningsigv4_a_alwaysSigningSIGV4A_ALWAYSSigningSIGV4A_ALWAYSSigningSIGV4A_ALWAYSSigningrequiredstatic#
Sign all origin requests using the AWS Signature Version 4A signing protocol.