拒绝访问由Amazon CloudFront的安全签名URL提供的图像，这些URL使用AWSJavaSDK链接到私有S3存储桶

Question

我使用AWS Java SDK创建签名URL，并尝试通过链接到私有S3 bucket的云端提供图像服务-已采取的步骤-

>

{String distributionDomain=“分布式域”；

String keyPairId="keyPairId";       
String s3ObjectKey=picName;
Date dateLessThan = DateUtils.parseISO8601Date("2014-01-12T21:20:00.000Z");


InputStream inputStream = ImageServiceImpl.class.getResourceAsStream("/cloudFront.der");
byte[] privateKeyBytes=IOUtils.toByteArray(inputStream);
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes);

KeyFactory keyFactory;
PrivateKey myPrivKey=null;
try {
    keyFactory = KeyFactory.getInstance("RSA");
    myPrivKey = keyFactory.generatePrivate(keySpec);
} catch (NoSuchAlgorithmException e) {
    e.printStackTrace();
}

System.out.println(myPrivKey);

String domainUrl= "https://" + distributionDomain + "/" + s3ObjectKey;
String url1 = CloudFrontUrlSigner.getSignedURLWithCannedPolicy(domainUrl, keyPairId, myPrivKey, dateLessThan);
System.out.println(url1);

}

当我点击URL安全签名URL时，我被拒绝访问，不确定我在这里错过了什么。如果需要任何其他信息，请告诉我。

Answer 1

我遵循本指南（https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html），像你一样，我也在使用Java所以我必须将CloudFront键转换为der格式（Java可以读取）。我使用以下openssl命令执行此操作：-

openssl pkcs8 -topk8 -nocrypt -in MyKey.pem -inform PEM -out MyKey.der -outform DER

转换密钥后，可以运行以下操作：-

public class AwsSignUrlCreator {

    public static void main(String[] args) throws InvalidKeySpecException, IOException {

        // The DNS name of your CloudFront distribution, or a registered alias
        String distributionDomainName = "xxxx.cloudfront.net";

        // the private key you created in the AWS Management Console 
        File cloudFrontPrivateKeyFile = new File ("C:/mykeys/MyKey.der");

        // The unique ID assigned to your CloudFront key pair in the console
        String cloudFrontKeyPairId = "xxxx";
        Date expirationDate = new Date(System.currentTimeMillis() + 60 * 1000);
        String s3ObjectKey = "my-file.txt";
        String signedUrl = CloudFrontUrlSigner.getSignedURLWithCannedPolicy(
            Protocol.https,
            distributionDomainName,
            cloudFrontPrivateKeyFile,
            s3ObjectKey,
            cloudFrontKeyPairId,
            expirationDate);

        System.out.println(signedUrl);
    }

}