title: AWS CloudFront Access-Control-Allow-Origin and Signed Cookie/Urls
body: <p>I'm stuck with a CORS at S3+Cloudfront+Signed Urls.</p>
  
  <p>My use cases is:</p>
  
  <p>First story (successful):    </p>
  
  <ol>
  <li><p>I have an Amazon S3 bucket with a Cloudfront. Files are accessible by the <code>DOMAIN1/file</code> link  </p></li>
  <li><p>I write a simple test JS script to get file from DOMAIN1 and put it at the <code>DOMAIN2/test.html</code>   </p></li>
  <li>I'm able to get file successfully. <strong>CORS is fine</strong>. </li>
  </ol>
  
  <p>Second case (successful too):</p>
  
  <ol>
  <li>I restrict Cloud Front distribution by using Signed Url.</li>
  <li>At first I tried is to access a file at DOMAIN1 <strong>without</strong> Signature. Got an Access denied. It's ok, since request is not signed.</li>
  <li>I've created a signed URL and <strong>able to download</strong> the file successfully.</li>
  </ol>
  
  <p>Third case (failed)</p>
  
  <ol>
  <li>I put signed url (from 2nd case) to the <code>DOMAIN2/test.html</code> test script</li>
  <li>And always got a <code>No 'Access-Control-Allow-Origin' header</code> error.</li>
  </ol>
  
  <p>So Cloudfront is not sending a header in case of restricted distribution. </p>
  
  <p>CORS xml is:</p>
  
  <pre><code>&lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;http://*&lt;/AllowedOrigin&gt;
      &lt;AllowedOrigin&gt;https://*&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;HEAD&lt;/AllowedMethod&gt;
      &lt;MaxAgeSeconds&gt;10&lt;/MaxAgeSeconds&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  </code></pre>
  
  <p></p>
  
  <p>It must be some issue in the CloudFront/S3/IAM settings. How I can fix it?</p>