title: How can I create development and production Cloudfront key pairs?
body: <p>I'm working on a system that uses Amazon S3 to store sensitive user media, which users access via a Cloudfront distribution. I'm locking down public access using <a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html" rel="nofollow noreferrer">Cloudfront's query parameter authentication</a> so that we create a secure string using a Cloudfront private key. This auth string can be attached to a Cloudfront URL to allow access only to appropriate S3 resources.</p>
  
  <p>However, I'm a little confused on the best way to distribute this private key amongst my team for development. Usually we would have a secret production key that only works for our production distribution and a less secret development key that works on our staging distributions.</p>
  
  <p>However, the Cloudfront docs indicate that keypairs <a href="https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html" rel="nofollow noreferrer">can only be created by the root AWS user</a>, who is allowed a maximum of 2 keys (for key rotation purposes). At the same time, the docs indicate that you can <a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html" rel="nofollow noreferrer">specify different accounts as trusted signers</a> and limit them to specific distributions. If this is true, I believe I could lock down specific distributions to keys created by specific users.</p>
  
  <p>Can anyone help me understand:</p>
  
  <ol>
  <li>if the root user is actually the only user that can create cloudfront key pairs? (Maybe through <a href="https://aws.amazon.com/organizations/" rel="nofollow noreferrer">Organizations</a>, I can create other non-IAM, root-like users?)</li>
  <li>how we might create a development key pair that only allows access to our development distributions?</li>
  </ol>
  
  <p>Thanks for the help!</p>