title: Cloudfront signed urls for EACH user: IP address vs. public key
body: <p><strong>AWS <a href="http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html" rel="nofollow noreferrer">Cloudfront signed urls</a> Question:</strong> I'm wondering about the pros and cons of controlling Cloudfront content access on a user-by-user basis using a publicly viewable key vs. their IP address. I'm defining a public key as an arbitrary access token (e.g., a public key or ID that <strong>I've</strong> assigned to each user) as a query parameter (part 3 in the picture below, taken from the docs. The user IP address can readily be obtained  server-side (with PHP using $_SERVER['REMOTE_ADDR'])  and is a value encoded in the "<code>Policy=</code>", i.e, part 4 in the picture.</p>
  
  <p><img src="https://i.stack.imgur.com/SWPzj.png" alt="Cloudfront Signed Url example"></p>
  
  <p>Because people increasingly have many computers and belong to many networks, IP address-based access would seem a suboptimal approach and mean that each user would need to have multiple policies and I'd have to keep track of each of these policies.</p>
  
  <p>On the other hand, the query string <code>public key</code>-based access could be thwarted by simple cut and paste or brute force if the string is harder to know.</p>
  
  <p>There must be reasons AWS recommends the IP-based approach and doesn't recommend the public key approach, but I'm having trouble understand what the point of the query parameter would be then if for not some kind of access token purpose. Thoughts?</p>
  
  <p><em>Background for newcomers: Cloudfront signed urls allow restricting access to the content on a server (called an "origin server" in the docs) such as your S3 bucket. These signed urls can be customized (called a "custom policy", the <code>Policy="eyANC.."</code> part of the url above) to include the user IP address such that if you aren't using that IP address you can't have access to the content.</em></p>