How CloudFront caching works with pre-signed URLs and CORS

Question

Hi,

I'm looking for help with understanding how everything works in the following scenario:

1. I have an S3 bucket with origin access control configured for my CloudFront distribution.
2. S3 and CloudFront have configured CORS with `Access-Control-Allow-Origin: *` for this specific environment to simplify it.
3. CloudFront behaviour has the following settings: Cache policy: `CachingOptimized`, Origin request policy: `CORS-S3Origin`, Response header policy: `SimpleCORS`
4. CloudFront has a public key configured and provides access only for pre-signed URLs.

How does caching work in this case? If I understand it, someone will request a file without query parameters `?Expires=111111&Signature=xxxxx` it will cache 403 response and all following requests will fail because of the `CachingOptimized` policy, which doesn't check query parameters.
In what order is CloudFront processing request? If it first checks the pre-signed URL, and if all is good, then provides the file from the cache without query parameters, all should be ok, but I see some strange behaviour of the cache in my case.

Accepted Answer

Hi,

You should look at this page to understand the full mechanism: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html

Section "How signed URLs work" say:

```
CloudFront uses the public key to validate the signature and confirm that the URL hasn't 
been tampered with. If the signature is invalid, the request is rejected.

If the signature is valid, CloudFront looks at the policy statement in the URL (or constructs 
one if you're using a canned policy) to confirm that the request is still valid. For example, 
if you specified a beginning and ending date and time for the URL, CloudFront confirms that 
the user is trying to access your content during the time period that you want to allow access.

If the request meets the requirements in the policy statement, CloudFront does the standard 
operations: determines whether the file is already in the edge cache, forwards the request to 
the origin if necessary, and returns the file to the user.
```

Best,

Didier

How CloudFront caching works with pre-signed URLs and CORS

Relevant content