title: Can't sign cloudfront URLs using boto
body: <p>I've written the following code to sign URLS using boto, however, I'm unable to access the signed URLS. Any help would be greatly appreciated.</p>
  
  <pre><code>con = cloudfront.CloudFrontConnection(
      settings.AWS_USER_DETAILS.access_key_id,
      settings.AWS_USER_DETAILS.secret_key_id,
  )
  
  identities = con.get_all_origin_access_identity()
  
  if len(identities) &lt; 1:
      oai = con.create_origin_access_identity(
          'cv-oai',
          'OAI signing iOS video requests'
      )
  else:
      oai = con.get_all_origin_access_identity()[0]
  
  distro_summary = con.get_all_distributions()[0]
  distro_info = con.get_distribution_info(distro_summary.id)
  
  bucket = boto.connect_s3(
      settings.AWS_USER_DETAILS.access_key_id,
      settings.AWS_USER_DETAILS.secret_key_id,
      host='s3-eu-west-1.amazonaws.com'
  ).get_bucket(u'cv-video')
  
  key_str = video.video_url.split('/')[-1]
  key = bucket.get_key(key_str)
  
  key.add_user_grant("READ", oai.s3_user_id)
  
  distro = distro_summary.get_distribution()
  
  # For local testing
  if ip_addr == '127.0.0.1':
      ip_addr = None
  
  private_key_string = open(settings.CF_PRIV_KEY_LOC).read()
  print private_key_string
  
  signed_url = distro.create_signed_url(
      "https://%s/%s" % (distro_info.domain_name, key_str),
      'APKAI3I3QZ7I73OIQIXA',
      expire_time=int(time.time()) + video.video_length + 5 * 60,
      #valid_after_time=None,
      #ip_address=ip_addr,
      #policy_url=None,
      private_key_string=private_key_string
  )
  </code></pre>
  
  <p><strong>Error:</strong></p>
  
  <p><strong>Update:</strong> This is the error received when visiting the URLs generated by the above code. I am unable to find documentation of the CloudFront errors to determine why this might be happening.</p>
  
  <pre><code>&lt;Error&gt;
  &lt;Code&gt;InvalidKey&lt;/Code&gt;
  &lt;Message&gt;Unknown Key&lt;/Message&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p><strong>Example URL:</strong></p>
  
  <p><a href="https://d1xvt07pr26drp.cloudfront.net/2iwjz3wn9atqlfw4.mov?Expires=1388705061&amp;Signature=auPWW-X1LzZJkPxJ5YPCqQMatchbAb3BxCWTG5oMY78G6LrH0sZiQL6EKdCX-l3Fi9E475b11uFL~HnxfBUY9QqQH86478QU5BnpmR-U7uEikRs7kTDWOVj4Riv3PHUmjmzlBW8xU7-n9C0m2UZSXedPsYYFdPoWHH0VLlyKk2TzgYydLqu~jtq0iNdmz-C9TOgUCaICiMYi082AVc7bt6xTfVszA9BeAD4KLKnr42raFDLojbA78Q-7bLNA2CiStdT-8BblQOQ5IXUCxYdkw7ak0vp77vER1pCG9cEBkCHD~9dZccyQEGJApO~ax4D5wDtCpeQj3l0pW6kYNUlP8Q__&amp;Key-Pair-Id=APKAI3I3QZ7I73OIQIXA" rel="noreferrer">https://d1xvt07pr26drp.cloudfront.net/2iwjz3wn9atqlfw4.mov?Expires=1388705061&amp;Signature=auPWW-X1LzZJkPxJ5YPCqQMatchbAb3BxCWTG5oMY78G6LrH0sZiQL6EKdCX-l3Fi9E475b11uFL~HnxfBUY9QqQH86478QU5BnpmR-U7uEikRs7kTDWOVj4Riv3PHUmjmzlBW8xU7-n9C0m2UZSXedPsYYFdPoWHH0VLlyKk2TzgYydLqu~jtq0iNdmz-C9TOgUCaICiMYi082AVc7bt6xTfVszA9BeAD4KLKnr42raFDLojbA78Q-7bLNA2CiStdT-8BblQOQ5IXUCxYdkw7ak0vp77vER1pCG9cEBkCHD~9dZccyQEGJApO~ax4D5wDtCpeQj3l0pW6kYNUlP8Q__&amp;Key-Pair-Id=APKAI3I3QZ7I73OIQIXA</a></p>
  
  <p><strong>The key pair is definitely active:</strong></p>
  
  <p><img src="https://i.stack.imgur.com/5Egd9.png" alt="Key Pair is active"></p>
  
  <p><strong>There is only one Origin Access Identity and one distribution:</strong></p>
  
  <pre><code>[&lt;boto.cloudfront.identity.OriginAccessIdentitySummary object at 0x10f356110&gt;]
  [&lt;boto.cloudfront.distribution.DistributionSummary object at 0x10f356090&gt;]
  </code></pre>