I encountered a really strange issue lately when using Amazon CloudFront, and I couldn't figure out why. Here is my setup: S3 bucket (A) with OAI s3:GetObject configured in the bucket policy CloudFront with S3 origin (A) and trusted signer configured to restrict viewer access So far so good. It's a pretty simple and straightforward setup. Now here comes the weird part. If I forward Host header to the origin (in this case bucket A), then the CloudFront signed URL would return SignatureDoesNotMatch error. Does anyone know why this would happen? Thanks in advance.

Forwarding Host header to the origin resulted in SignatureDoesNotMatch error thrown from S3

I encountered a really strange issue lately when using Amazon CloudFront, and I couldn't figure out why. Here is my setup:

S3 bucket (A) with OAI s3:GetObject configured in the bucket policy
CloudFront with S3 origin (A) and trusted signer configured to restrict viewer access

So far so good. It's a pretty simple and straightforward setup. Now here comes the weird part.

If I forward Host header to the origin (in this case bucket A), then the CloudFront signed URL would return SignatureDoesNotMatch error.

Does anyone know why this would happen? Thanks in advance.