# Signing

Options for how CloudFront signs requests.

- Source: [`aws-cloudfront/lib/origin-access-control.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cloudfront/lib/origin-access-control.ts#L166)
- Type last changed: v2.275.0 · 26 Oct 2026

## Example

```ts
const myBucket = new s3.Bucket(this, 'myBucket');
const oac = new cloudfront.S3OriginAccessControl(this, 'MyOAC', {
  signing: cloudfront.Signing.SIGV4_NO_OVERRIDE
});
const s3Origin = origins.S3BucketOrigin.withOriginAccessControl(myBucket, {
    originAccessControl: oac
  }
)
new cloudfront.Distribution(this, 'myDist', {
  defaultBehavior: {
    origin: s3Origin
  },
});
```

## Initializer

```ts
new Signing(protocol: SigningProtocol, behavior: SigningBehavior)
```

## Properties

- `behavior`: [SigningBehavior](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.SigningBehavior.html) — Which requests CloudFront signs.

- `NEVER`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Do not sign any origin requests.

- `protocol`: [SigningProtocol](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.SigningProtocol.html) — The signing protocol.

- `SIGV4_ALWAYS`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Sign all origin requests using the AWS Signature Version 4 signing protocol.

- `SIGV4_ALWAYS_AMZ_AUTH`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Sign all origin requests using the AWS Signature Version 4 signing protocol, and pass the viewer's Authorization header to the origin unchanged.

- `SIGV4_NO_OVERRIDE`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Sign only if the viewer request doesn't contain the Authorization header using the AWS Signature Version 4 signing protocol.

- `SIGV4A_ALWAYS`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Sign all origin requests using the AWS Signature Version 4A signing protocol.

- `SIGV4A_ALWAYS_AMZ_AUTH`: [Signing](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.Signing.html) (static) — Sign all origin requests using the AWS Signature Version 4A signing protocol, and pass the viewer's Authorization header to the origin unchanged.