Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

CreateKeyGroup

Creates a key group that you can use with CloudFront signed URLs and signed cookies.

To create a key group, you must specify at least one public key for the key group. After you create a key group, you can reference it from one or more cache behaviors. When you reference a key group in a cache behavior, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see Serving private content in the Amazon CloudFront Developer Guide.

Request Syntax


POST /2020-05-31/key-group HTTP/1.1
<?xml version="1.0" encoding="UTF-8"?>
<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <Comment>string</Comment>
   <Items>
      <PublicKey>string</PublicKey>
   </Items>
   <Name>string</Name>
</KeyGroupConfig>

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in XML format.

KeyGroupConfig

Root level tag for the KeyGroupConfig parameters.

Required: Yes

Comment

A comment to describe the key group. The comment cannot be longer than 128 characters.

Type: String

Required: No

Items

A list of the identifiers of the public keys in the key group.

Type: Array of strings

Required: Yes

Name

A name to identify the key group.

Type: String

Required: Yes

Response Syntax


HTTP/1.1 201
<?xml version="1.0" encoding="UTF-8"?>
<KeyGroup>
   <Id>string</Id>
   <KeyGroupConfig>
      <Comment>string</Comment>
      <Items>
         <PublicKey>string</PublicKey>
      </Items>
      <Name>string</Name>
   </KeyGroupConfig>
   <LastModifiedTime>timestamp</LastModifiedTime>
</KeyGroup>

Response Elements

If the action is successful, the service sends back an HTTP 201 response.

The following data is returned in XML format by the service.

KeyGroup

Root level tag for the KeyGroup parameters.

Required: Yes

Id

The identifier for the key group.

Type: String

KeyGroupConfig

The key group configuration.

Type: KeyGroupConfig object

LastModifiedTime

The date and time when the key group was last modified.

Type: Timestamp

Errors

For information about the errors that are common to all actions, see Common Errors.

InvalidArgument

An argument is invalid.

HTTP Status Code: 400

KeyGroupAlreadyExists

A key group with this name already exists. You must provide a unique name. To modify an existing key group, use UpdateKeyGroup.

HTTP Status Code: 409

TooManyKeyGroups

You have reached the maximum number of key groups for this AWS account. For more information, see Quotas (formerly known as limits) in the Amazon CloudFront Developer Guide.

HTTP Status Code: 400

TooManyPublicKeysInKeyGroup

The number of public keys in this key group is more than the maximum allowed. For more information, see Quotas (formerly known as limits) in the Amazon CloudFront Developer Guide.

HTTP Status Code: 400