title: Why 'Missing Key-Pair-Id query parameter or cookie value'
body: <p>I am trying use signed url to serve S3 bucket as private content via AWS cloudfront.</p>
  
  <p>However I keep getting this error 'Missing Key-Pair-Id query parameter or cookie value'</p>
  
  <pre><code>&lt;Error&gt;
  &lt;Code&gt;MissingKey&lt;/Code&gt;
  &lt;Message&gt;
  Missing Key-Pair-Id query parameter or cookie value
  &lt;/Message&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>Here is an example url</p>
  
  <p><a href="http://test.example.com/TestContent/test.html?Expires=1431195459&amp;Signature=DSk8HwFScg6EFJla1p8UHB9EM28zXB7k5AwrXZjzByzdlTSMCG-md6MvUFT~pneaahfPbCcvxNWqZNYu5Dc1IE1JrjOhFP52APFsVmJDlPmqoQzOoCECclEsSvMpTPgva8L4TazDLtI6E5EuV632y76ZA8XoT2KHhzcj7ux9XhvQ6wyiiQxK9rb13sZJ~Cm~4qI-028dd6UkEIu1tUIM~SFh72wYjik7v8sfz2z5T5bZGZJrrfryO0zA9wpkabFA8JkrmfuBm55XWqcVk5OSOkrNn7iyuXwmrEeBJxufaiWE84UbfS8He12fh6~-seTr7UnOCtC4mBf4qlGsxCzKiw__&amp;Key-Pair-Id=my-test-key" rel="noreferrer">http://test.example.com/TestContent/test.html?Expires=1431195459&amp;Signature=DSk8HwFScg6EFJla1p8UHB9EM28zXB7k5AwrXZjzByzdlTSMCG-md6MvUFT~pneaahfPbCcvxNWqZNYu5Dc1IE1JrjOhFP52APFsVmJDlPmqoQzOoCECclEsSvMpTPgva8L4TazDLtI6E5EuV632y76ZA8XoT2KHhzcj7ux9XhvQ6wyiiQxK9rb13sZJ~Cm~4qI-028dd6UkEIu1tUIM~SFh72wYjik7v8sfz2z5T5bZGZJrrfryO0zA9wpkabFA8JkrmfuBm55XWqcVk5OSOkrNn7iyuXwmrEeBJxufaiWE84UbfS8He12fh6~-seTr7UnOCtC4mBf4qlGsxCzKiw__&amp;Key-Pair-Id=my-test-key</a></p>
  
  <p>I have verified that I do not have any invalid characters ('+', '=', '/') in the signature.</p>
  
  <p>And <code>Key-Pair-Id</code> is clearly present in the signed url.</p>
  
  <p>My questions:</p>
  
  <p>1) <code>my-test-key</code> is created using my IAM. Is it a problem?</p>
  
  <p>2) Is it a must to provide a policy in a signed url?</p>
  
  <p>3) Do I need to grant any permission to the object <code>TestContent/test.html</code> to the OAI?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>If I change the Key-Pair-Id value to something else, I will get a different error message </p>
  
  <pre><code>&lt;Error&gt;
  &lt;Code&gt;InvalidKey&lt;/Code&gt;
  &lt;Message&gt;Unknown Key&lt;/Message&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>So apparently Key-Pair-Id is accepted by aws cloudfront.</p>