Elixir Cloudfront signed urls

cloudfront_signer.ex

defmodule CloudfrontSigner do
  def signed_url(cloudfront_key_pem, key_pair, url, expiry_time) do
    decoded_key = cloudfront_key_pem |> decode_key
    expiry_time = :os.system_time(:second) + expiry_time
    policy = policy(url, expiry_time)

    signature =
      :public_key.sign(policy, :sha, decoded_key)
      |> Base.encode64()
      |> String.replace("+", "-")
      |> String.replace("=", "_")
      |> String.replace("/", "~")

    "#{url}?Expires=#{expiry_time}&Signature=#{signature}&Key-Pair-Id=#{key_pair}"
  end

  defp decode_key(key) do
    key |> :public_key.pem_decode() |> hd |> :public_key.pem_entry_decode()
  end

  defp policy(url, expiry) do
    %{
      Statement: [
        %{
          Resource: url,
          Condition: %{
            DateLessThan: %{
              "AWS:EpochTime": expiry
            }
          }
        }
      ]
    }
    |> Poison.encode!()
  end
end