aws-sdk-cloudfront 1.154.0 → 1.156.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 954fa182dffe203eea931bf9910d6648ffb3a539694fc89ae1d09d1440964965
-  data.tar.gz: fef6f98963a4de65fe744d812ac30ed45091d9b41cb1c4abfdb1956b3b03cd78
+  metadata.gz: b356540626e44f75082d1ac97586be5d46a097fa791930957f7c39bc31ee2033
+  data.tar.gz: 352e9eed509f4407c6e56c3fb765b827d9b8bdfa377e63e6c005ac55bbc13953
 SHA512:
-  metadata.gz: 9ea4f808206542ea0c10945ee3fd56205ff1b3333c9265c1096bba34ed9e5b620b5029f73fa2122b8422bf1ffedf849615d3ed1006e3a9e82f72c90907bdd131
-  data.tar.gz: cb37d3b7ce1f67044044a014636e39964562cebef3a2ff33427c7d62a51f41779de15c3123ebc88686a76721d2707566ce7b96bfa3fa81c961e8482ecaf67886
+  metadata.gz: 5d8ca45e758703d00ed160e2f64ae2d35eb2f194d8604b3fbb052aace34245ef5f0e6e20fb10ce049dd84c72b176f53cc0f76eaaa87090bcae87ff238ee81f08
+  data.tar.gz: e98d42fbee66e65212600bf0d233844a3c8140700a3826fff77cb2e609e102cf8100233738b67fbfe53fd8787f42fa8a3212cce54422afa0cf6bd504951dcf9e

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.156.0 (2026-10-01)
+------------------
+
+* Feature - Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins.
+
+1.155.0 (2026-09-23)
+------------------
+
+* Feature - CloudFront signers now support SHA-256 signatures via the `:hash_algorithm` option (`'SHA1'` or `'SHA256'`, defaults to `'SHA1'`). Signers also validate that the private key is RSA or ECDSA (P-256), and custom policies are now minified before signing.
+
 1.154.0 (2026-09-11)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.154.0
+1.156.0

data/lib/aws-sdk-cloudfront/client.rb

@@ -3213,7 +3213,7 @@ module Aws::CloudFront
     #       name: "string", # required
     #       description: "string",
     #       signing_protocol: "sigv4", # required, accepts sigv4, sigv4a
-    #       signing_behavior: "never", # required, accepts never, always, no-override
+    #       signing_behavior: "never", # required, accepts never, always, no-override, always-amz-auth
     #       origin_access_control_origin_type: "s3", # required, accepts s3, mediastore, mediapackagev2, lambda
     #     },
     #   })
@@ -3224,7 +3224,7 @@ module Aws::CloudFront
     #   resp.origin_access_control.origin_access_control_config.name #=> String
     #   resp.origin_access_control.origin_access_control_config.description #=> String
     #   resp.origin_access_control.origin_access_control_config.signing_protocol #=> String, one of "sigv4", "sigv4a"
-    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override"
+    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override", "always-amz-auth"
     #   resp.origin_access_control.origin_access_control_config.origin_access_control_origin_type #=> String, one of "s3", "mediastore", "mediapackagev2", "lambda"
     #   resp.location #=> String
     #   resp.etag #=> String
@@ -6504,7 +6504,7 @@ module Aws::CloudFront
     #   resp.origin_access_control.origin_access_control_config.name #=> String
     #   resp.origin_access_control.origin_access_control_config.description #=> String
     #   resp.origin_access_control.origin_access_control_config.signing_protocol #=> String, one of "sigv4", "sigv4a"
-    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override"
+    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override", "always-amz-auth"
     #   resp.origin_access_control.origin_access_control_config.origin_access_control_origin_type #=> String, one of "s3", "mediastore", "mediapackagev2", "lambda"
     #   resp.etag #=> String
     #
@@ -6538,7 +6538,7 @@ module Aws::CloudFront
     #   resp.origin_access_control_config.name #=> String
     #   resp.origin_access_control_config.description #=> String
     #   resp.origin_access_control_config.signing_protocol #=> String, one of "sigv4", "sigv4a"
-    #   resp.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override"
+    #   resp.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override", "always-amz-auth"
     #   resp.origin_access_control_config.origin_access_control_origin_type #=> String, one of "s3", "mediastore", "mediapackagev2", "lambda"
     #   resp.etag #=> String
     #
@@ -10289,7 +10289,7 @@ module Aws::CloudFront
     #   resp.origin_access_control_list.items[0].description #=> String
     #   resp.origin_access_control_list.items[0].name #=> String
     #   resp.origin_access_control_list.items[0].signing_protocol #=> String, one of "sigv4", "sigv4a"
-    #   resp.origin_access_control_list.items[0].signing_behavior #=> String, one of "never", "always", "no-override"
+    #   resp.origin_access_control_list.items[0].signing_behavior #=> String, one of "never", "always", "no-override", "always-amz-auth"
     #   resp.origin_access_control_list.items[0].origin_access_control_origin_type #=> String, one of "s3", "mediastore", "mediapackagev2", "lambda"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cloudfront-2020-05-31/ListOriginAccessControls AWS API Documentation
@@ -13064,7 +13064,7 @@ module Aws::CloudFront
     #       name: "string", # required
     #       description: "string",
     #       signing_protocol: "sigv4", # required, accepts sigv4, sigv4a
-    #       signing_behavior: "never", # required, accepts never, always, no-override
+    #       signing_behavior: "never", # required, accepts never, always, no-override, always-amz-auth
     #       origin_access_control_origin_type: "s3", # required, accepts s3, mediastore, mediapackagev2, lambda
     #     },
     #     id: "string", # required
@@ -13077,7 +13077,7 @@ module Aws::CloudFront
     #   resp.origin_access_control.origin_access_control_config.name #=> String
     #   resp.origin_access_control.origin_access_control_config.description #=> String
     #   resp.origin_access_control.origin_access_control_config.signing_protocol #=> String, one of "sigv4", "sigv4a"
-    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override"
+    #   resp.origin_access_control.origin_access_control_config.signing_behavior #=> String, one of "never", "always", "no-override", "always-amz-auth"
     #   resp.origin_access_control.origin_access_control_config.origin_access_control_origin_type #=> String, one of "s3", "mediastore", "mediapackagev2", "lambda"
     #   resp.etag #=> String
     #
@@ -13815,7 +13815,7 @@ module Aws::CloudFront
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudfront'
-      context[:gem_version] = '1.154.0'
+      context[:gem_version] = '1.156.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudfront/cookie_signer.rb

@@ -12,12 +12,20 @@ module Aws
     #
     #     signer = Aws::CloudFront::CookieSigner.new(
     #       key_pair_id: "cf-keypair-id",
-    #       private_key_path: "./unit_test_dummy_key"
+    #       private_key_path: "./private_key.pem"
     #     )
     #     cookies = signer.signed_cookie(url,
     #       policy: policy.to_json
     #     )
     #
+    # Pass `hash_algorithm: 'SHA256'` to sign with SHA-256 instead of SHA-1:
+    #
+    #     signer = Aws::CloudFront::CookieSigner.new(
+    #       key_pair_id: "cf-keypair-id",
+    #       private_key_path: "./private_key.pem",
+    #       hash_algorithm: "SHA256"
+    #     )
+    #
     class CookieSigner
       include Signer
 

data/lib/aws-sdk-cloudfront/signer.rb

@@ -8,13 +8,18 @@ require 'openssl'
 module Aws
   module CloudFront
     module Signer
+      # @api private
+      SUPPORTED_HASH_ALGORITHMS = %w[SHA1 SHA256].freeze
+
       # @option options [String] :key_pair_id
       # @option options [String] :private_key
       # @option options [String] :private_key_path
+      # @option options [String] :hash_algorithm ('SHA1') 'SHA1' or 'SHA256'
       def initialize(options = {})
         @key_pair_id = key_pair_id(options)
-        @cipher = OpenSSL::Digest.new('SHA1')
-        @private_key = OpenSSL::PKey.read(private_key(options))
+        @hash_algorithm = hash_algorithm(options)
+        @cipher = OpenSSL::Digest.new(@hash_algorithm)
+        @private_key = load_private_key(private_key(options))
       end
 
       private
@@ -78,7 +83,7 @@ module Aws
       def signature(params = {})
         signature_content = {}
         if params[:policy]
-          policy = params[:policy].gsub('/\s/s', '')
+          policy = params[:policy].gsub(/\s/, '')
           signature_content['Policy'] = encode(policy)
         elsif params[:resource] && params[:expires]
           policy = canned_policy(params[:resource], params[:expires])
@@ -90,12 +95,18 @@ module Aws
 
         signature_content['Signature'] = encode(sign_policy(policy))
         signature_content['Key-Pair-Id'] = @key_pair_id
+        # omitted for SHA1 to keep existing signed URLs and cookies unchanged
+        signature_content['Hash-Algorithm'] = @hash_algorithm if @hash_algorithm == 'SHA256'
         signature_content
       end
 
       # create the signature string with policy signed
       def sign_policy(policy)
         @private_key.sign(@cipher, policy)
+      rescue OpenSSL::PKey::PKeyError => e
+        msg = "failed to sign with #{@hash_algorithm}: #{e.message}"
+        msg += ", consider `hash_algorithm: 'SHA256'`" if @hash_algorithm == 'SHA1'
+        raise ArgumentError, msg
       end
 
       # create canned policy that used for signing
@@ -121,6 +132,16 @@ module Aws
         options[:key_pair_id]
       end
 
+      def hash_algorithm(options)
+        algorithm = (options[:hash_algorithm] || 'SHA1').to_s.upcase
+        unless SUPPORTED_HASH_ALGORITHMS.include?(algorithm)
+          msg = ":hash_algorithm must be one of #{SUPPORTED_HASH_ALGORITHMS.join(', ')}"
+          raise ArgumentError, msg
+        end
+
+        algorithm
+      end
+
       def private_key(options)
         if options[:private_key]
           options[:private_key]
@@ -131,6 +152,23 @@ module Aws
           raise ArgumentError, msg
         end
       end
+
+      def load_private_key(pem)
+        key = OpenSSL::PKey.read(pem)
+        case key
+        when OpenSSL::PKey::RSA
+          key
+        when OpenSSL::PKey::EC
+          curve = key.group.curve_name
+          raise ArgumentError, "unsupported ECDSA curve `#{curve}', must be prime256v1" unless curve == 'prime256v1'
+
+          key
+        else
+          raise ArgumentError, "unsupported private key type #{key.class}, must be RSA or ECDSA"
+        end
+      rescue OpenSSL::PKey::PKeyError
+        raise ArgumentError, 'invalid private key, must be a PEM-encoded RSA or ECDSA private key'
+      end
     end
   end
 end

data/lib/aws-sdk-cloudfront/types.rb

@@ -11532,6 +11532,15 @@ module Aws::CloudFront
     #     [cache policy][2] for all cache behaviors that use origins
     #     associated with this origin access control.**
     #
+    #   * `always-amz-auth` – CloudFront signs all origin requests with
+    #     Amazon authentication headers. If the viewer request contains the
+    #     `Authorization` header, then CloudFront also forwards that header
+    #     to the origin. This value is only valid with Lambda-Web origins.
+    #     **WARNING: To forward the `Authorization` header from the viewer
+    #     request, you *must* add the `Authorization` header to a [cache
+    #     policy][2] for all cache behaviors that use origins associated
+    #     with this origin access control.**
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#oac-advanced-settings
@@ -11645,6 +11654,11 @@ module Aws::CloudFront
     #     the viewer request contains the `Authorization` header, CloudFront
     #     doesn't sign the origin request, but instead passes along the
     #     `Authorization` header that it received in the viewer request.
+    #
+    #   * `always-amz-auth` – CloudFront signs all origin requests with
+    #     Amazon authentication headers, and forwards the viewer's
+    #     `Authorization` header to the origin if one is present. This value
+    #     is only valid with Lambda-Web origins.
     #   @return [String]
     #
     # @!attribute [rw] origin_access_control_origin_type

data/lib/aws-sdk-cloudfront/url_signer.rb

@@ -12,12 +12,20 @@ module Aws
     #
     #     signer = Aws::CloudFront::UrlSigner.new(
     #       key_pair_id: "cf-keypair-id",
-    #       private_key_path: "./unit_test_dummy_key"
+    #       private_key_path: "./private_key.pem"
     #     )
     #     url = signer.signed_url(url,
     #       policy: policy.to_json
     #     )
     #
+    # Pass `hash_algorithm: 'SHA256'` to sign with SHA-256 instead of SHA-1:
+    #
+    #     signer = Aws::CloudFront::UrlSigner.new(
+    #       key_pair_id: "cf-keypair-id",
+    #       private_key_path: "./private_key.pem",
+    #       hash_algorithm: "SHA256"
+    #     )
+    #
     class UrlSigner
       include Signer
 

data/lib/aws-sdk-cloudfront.rb

@@ -55,7 +55,7 @@ module Aws::CloudFront
   autoload :EndpointProvider, 'aws-sdk-cloudfront/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-cloudfront/endpoints'
 
-  GEM_VERSION = '1.154.0'
+  GEM_VERSION = '1.156.0'
 
 end
 

data/sig/client.rbs

@@ -464,7 +464,7 @@ module Aws
                                             name: ::String,
                                             description: ::String?,
                                             signing_protocol: ("sigv4" | "sigv4a"),
-                                            signing_behavior: ("never" | "always" | "no-override"),
+                                            signing_behavior: ("never" | "always" | "no-override" | "always-amz-auth"),
                                             origin_access_control_origin_type: ("s3" | "mediastore" | "mediapackagev2" | "lambda")
                                           }
                                         ) -> _CreateOriginAccessControlResponseSuccess
@@ -2065,7 +2065,7 @@ module Aws
                                             name: ::String,
                                             description: ::String?,
                                             signing_protocol: ("sigv4" | "sigv4a"),
-                                            signing_behavior: ("never" | "always" | "no-override"),
+                                            signing_behavior: ("never" | "always" | "no-override" | "always-amz-auth"),
                                             origin_access_control_origin_type: ("s3" | "mediastore" | "mediapackagev2" | "lambda")
                                           },
                                           id: ::String,

data/sig/types.rbs

@@ -2852,7 +2852,7 @@ module Aws::CloudFront
       attr_accessor name: ::String
       attr_accessor description: ::String
       attr_accessor signing_protocol: ("sigv4" | "sigv4a")
-      attr_accessor signing_behavior: ("never" | "always" | "no-override")
+      attr_accessor signing_behavior: ("never" | "always" | "no-override" | "always-amz-auth")
       attr_accessor origin_access_control_origin_type: ("s3" | "mediastore" | "mediapackagev2" | "lambda")
       SENSITIVE: []
     end
@@ -2877,7 +2877,7 @@ module Aws::CloudFront
       attr_accessor description: ::String
       attr_accessor name: ::String
       attr_accessor signing_protocol: ("sigv4" | "sigv4a")
-      attr_accessor signing_behavior: ("never" | "always" | "no-override")
+      attr_accessor signing_behavior: ("never" | "always" | "no-override" | "always-amz-auth")
       attr_accessor origin_access_control_origin_type: ("s3" | "mediastore" | "mediapackagev2" | "lambda")
       SENSITIVE: []
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudfront
 version: !ruby/object:Gem::Version
-  version: 1.154.0
+  version: 1.156.0
 platform: ruby
 authors:
 - Amazon Web Services