It's described here: http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/index.html?PrivateContent.html http://docs.amazonwebservices.com/

It's described here: http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/index.html?PrivateContent.html http://docs.amazonwebservices.com/AmazonCloudFront/latest/De... It works mostly like S3 signed requests (last section of the following URL): http://docs.amazonwebservices.com/AmazonS3/latest/RESTAuthentication.html#RESTAuthenticationQueryStringAuth http://docs.amazonwebservices.com/AmazonS3/latest/RESTAuthen... ... except with an added step of making a CloudFront identity that is the only entity allowed to access the S3 object behind what you want to serve via CloudFront.