Problem with serving private signed media from S3 using custom domain media.mydomain.com thru CloudFront.

The issue you're experiencing with serving private signed media from S3 through CloudFront using a custom domain appears to be related to permissions and configuration settings. Here are some potential causes and solutions to consider:

1. S3 Bucket Policy: Ensure that your S3 bucket policy allows CloudFront to access the objects. The policy should include permissions for the CloudFront service principal to perform the s3:GetObject action on your bucket resources.

2. CloudFront Distribution Settings: Verify that your CloudFront distribution is correctly configured to use Origin Access Control (OAC) or Origin Access Identity (OAI) to access the S3 bucket securely. OAC is the newer and recommended approach.

3. Custom Domain Configuration: Make sure that your custom domain (media.mydomain.com) is properly set up in CloudFront as an alternate domain name (CNAME) and that the corresponding SSL certificate is correctly associated with the distribution.

4. Signed URLs Configuration: Check that the public and private key pair used for generating signed URLs is correctly set up in both CloudFront and your WordPress plugin (WP Offload Media). Ensure that the keys are in the correct format and haven't expired.

5. CloudFront Behaviors: Review your CloudFront distribution's behaviors to ensure they're configured to forward the necessary headers and query strings required for signed URLs to work properly.

6. S3 Bucket Encryption: If you're using server-side encryption on your S3 bucket, make sure that CloudFront is configured to handle encrypted objects correctly.

7. WordPress Plugin Settings: Double-check the WP Offload Media plugin settings to ensure it's correctly configured to work with CloudFront and signed URLs. Make sure the plugin is using the latest version of the AWS SDK and that all necessary IAM permissions are in place.

8. CloudFront Function or Lambda@Edge: Consider implementing a CloudFront Function or Lambda@Edge to handle any necessary URL rewriting or header modifications that might be required for your specific setup.

To troubleshoot further:

1. Review CloudFront and S3 access logs to identify the specific requests that are failing.
2. Temporarily enable more verbose error logging in CloudFront to get more detailed information about the 403 errors.
3. Test accessing the S3 objects directly (bypassing CloudFront) to isolate whether the issue is with S3 permissions or CloudFront configuration.
4. Verify that the AWS account IDs and ARNs in your configurations are accurate and up to date.

If the issue persists after checking these points, you may need to engage AWS support or consult with a specialist who has experience with this specific setup to review your entire configuration and identify any misconfigurations or incompatibilities.
Sources
Cloudfront cannot access s3 bucket | AWS re:Post
Serve private content with signed URLs and signed cookies - Amazon CloudFront
Access Denied for Cloudfront to s3 (2025) | AWS re:Post
Access Denied for CloudFront to S3 | AWS re:Post

Also verify that you have your Cross-Origin Resource Sharing (CORS) policy defined in your S3 Bucket, for further information please see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html