title: How can a Cloudfront distribution an AWS KMS key to GET an S3 image encrypted at rest?
body: <p>I would like to use <strong>AWS's Server Side Encryption (SSE)</strong> with the <strong>AWS Key Management Service (KMS)</strong> to encrypt data at rest in S3. (See this <a href="https://aws.amazon.com/blogs/security/how-to-use-the-rest-api-to-encrypt-s3-objects-by-using-aws-kms/" rel="noreferrer">AWS blog post</a> detailing SSE-KMS.)</p>
  
  <p>However, I also have the requirement that I use Cloudfront Presigned URLs. </p>
  
  <p>How can I set up a Cloudfront distribution to use a key in AWS KMS to decrypt and use S3 objects encrypted at rest?</p>
  
  <p>(<a href="https://github.com/boto/boto3/issues/1313" rel="noreferrer">This Boto3 issue</a> seems to be from someone looking for the same answers as me, but with no results).</p>