title: Amazon cloudfront. Usage of Trusted Signers
body: <p>We are using cloudfront for serving s3 resource and it is restricted. 
  In c#, while creating the presigned url using the "AmazonCloudFrontUrlSigner.SignUrlCanned" it does ask only for the cloudfront private key generated using the root credentials and doesn't ask for IAM user credentials.</p>
  
  <p>In the distribution behavior, I can see there is an option to specify the "Trusted Signers" but not able to understand where it is being used. Any info on this would be great. Also is there a way to generate presigned cloudfront url using the IAM user credentials? </p>