Example to generate Signed URLs in CloudFront using Custom Policy.

CloudFront Signed URL Custom Policy.js

const AWS = require('aws-sdk');

// Try to use process.env.PRIVATE_KEY instead of exposing your key
const privateKey = `-----BEGIN RSA PRIVATE KEY-----
  XXXXXXXX
  XXXXXXXX
  XXXXXXXX
  XXXXXXXX
-----END RSA PRIVATE KEY-----`

const cloudFront = new AWS.CloudFront.Signer('PUBLIC_ACCESS_KEY', privateKey);

const policy = JSON.stringify({
  "Statement": [
    {
      "Resource": "https://abcdefghijklmn.cloudfront.net/test/a.txt",
      "Condition": {
        "DateLessThan": {
          "AWS:EpochTime": Math.floor((new Date()).getTime() / 1000) + (60 * 60 * 1) // Current Time in UTC + time in seconds, (60 * 60 * 1 = 1 hour)
        }
      }
    }
  ]
});

cloudFront.getSignedUrl({
  policy,
}, (err, url) => {
  if (err) throw err;
  console.log(url);
});

It is caused by this line in the SDK. It seems it is necessary to provide the Resource URL as url property to the options argument.

//  ... same as gist
cloudFront.getSignedUrl({
  url: <resource_url_here_as_string>
  policy,
}, (err, url) => {
  if (err) throw err;
  console.log(url);
});