{"_id":"@carhensi/aws-cdk-cloudfront-key-pair","_rev":"14-32f33a5c683df3fc66609ea0e053b22c","name":"@carhensi/aws-cdk-cloudfront-key-pair","dist-tags":{"latest":"2.2.0"},"versions":{"1.1.2":{"name":"@carhensi/aws-cdk-cloudfront-key-pair","version":"1.1.2","keywords":["aws","cdk","aws-cdk","aws-cdk-construct","cloudfront","key-pair"],"author":{"name":"Carsten Hensiek","email":"carsten@hensiek.com"},"license":"MIT","_id":"@carhensi/aws-cdk-cloudfront-key-pair@1.1.2","maintainers":[{"name":"carhensi","email":"carsten@hensiek.com"}],"homepage":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair","bugs":{"url":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair/issues"},"dist":{"shasum":"82325e7248817f392d26a18f798f324441249a32","tarball":"https://registry.npmjs.org/@carhensi/aws-cdk-cloudfront-key-pair/-/aws-cdk-cloudfront-key-pair-1.1.2.tgz","fileCount":19,"integrity":"sha512-YVIUR6jb5ZIn0i+Ye4AFD48W3dC8fW/sTfK+nlO7f43vupRKi7kBPl0qDCvbVMPfQ0trPBjHd8KyyWUcEtFt/A==","signatures":[{"sig":"MEUCIBRjKYiOUtgz6dDr678873E06ZAYVTX+YUNxi/iGFZykAiEA0Ef36FP8SsgESOO0IhhXLTJhSYL50yMepqGg6RkfLHg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":108237},"main":"lib/index.js","types":"lib/index.d.ts","gitHead":"5a2add0f95f89ee23df2bf78c023794c5f6badca","scripts":{"build":"tsc","watch":"tsc -w","semantic-release":"semantic-release"},"_npmUser":{"name":"carhensi","email":"carsten@hensiek.com"},"repository":{"url":"git+https://github.com/carhensi/aws-cdk-cloudfront-key-pair.git","type":"git"},"_npmVersion":"10.9.4","description":"AWS CDK L3 construct for managing CloudFront trusted key group key pairs","directories":{},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"prettier":"^3.5.2","constructs":"^10.0.0","typescript":"~5.7.0","@types/node":"^24.0.0","aws-cdk-lib":"^2.233.0","semantic-release":"^24.2.9"},"peerDependencies":{"constructs":"^10.0.0","aws-cdk-lib":"^2.233.0"},"_npmOperationalInternal":{"tmp":"tmp/aws-cdk-cloudfront-key-pair_1.1.2_1767781827736_0.6224744520926051","host":"s3://npm-registry-packages-npm-production"}},"2.0.1":{"name":"@carhensi/aws-cdk-cloudfront-key-pair","version":"2.0.1","keywords":["aws","cdk","aws-cdk","aws-cdk-construct","cloudfront","key-pair"],"author":{"name":"Carsten Hensiek","email":"carsten@hensiek.com"},"license":"MIT","_id":"@carhensi/aws-cdk-cloudfront-key-pair@2.0.1","maintainers":[{"name":"carhensi","email":"carsten@hensiek.com"}],"homepage":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair","bugs":{"url":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair/issues"},"dist":{"shasum":"7be28da93868a07fc02087f94bcc4ee0a175852c","tarball":"https://registry.npmjs.org/@carhensi/aws-cdk-cloudfront-key-pair/-/aws-cdk-cloudfront-key-pair-2.0.1.tgz","fileCount":39,"integrity":"sha512-4P5Ws3VLncb92vKYTlI9SKuqH5jwA3FH9DFclZF+JUsg4KN77LvM4DJVGhuiZx8JygWX2SEHRpA7hngU6qjJLg==","signatures":[{"sig":"MEYCIQD2JoEk8KEfJlHvGhfnfxTCfxP/1aSgSj+T2GnUMOFLWgIhAIIy7M4j9ClfW8QDGhGKwm1nzxMIrv7ZYTy/0FAsQ1wN","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@carhensi%2faws-cdk-cloudfront-key-pair@2.0.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":376160},"main":"lib/index.js","types":"lib/index.d.ts","gitHead":"504dc4f638d9a7d15c892e167410c30e60362054","scripts":{"lint":"eslint lib src test --ext .ts","test":"jest","build":"tsc","format":"prettier --write \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","prepare":"husky","lint:fix":"eslint lib src test --ext .ts --fix","test:all":"npm test && npm run test:lambda","test:lambda":"npm run test --prefix src/create-key-pair","format:check":"prettier --check \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","semantic-release":"semantic-release"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:09849e5e-413d-4d3e-81a9-d2f7e12d18cf"}},"repository":{"url":"git+https://github.com/carhensi/aws-cdk-cloudfront-key-pair.git","type":"git"},"_npmVersion":"11.7.0","description":"AWS CDK L3 construct for managing CloudFront trusted key group key pairs","directories":{},"lint-staged":{"*.ts":["eslint --fix","prettier --write"]},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^30.2.0","husky":"^9.1.7","eslint":"^9.39.2","ts-jest":"^29.2.0","prettier":"^3.7.4","constructs":"^10.0.0","typescript":"~5.9.3","@types/jest":"^30.0.0","@types/node":"^25.0.3","aws-cdk-lib":"^2.233.0","lint-staged":"^16.2.7","semantic-release":"^25.0.2","typescript-eslint":"^8.52.0","@typescript-eslint/parser":"^8.52.0","@typescript-eslint/eslint-plugin":"^8.52.0"},"peerDependencies":{"constructs":"^10.0.0","aws-cdk-lib":"^2.233.0"},"_npmOperationalInternal":{"tmp":"tmp/aws-cdk-cloudfront-key-pair_2.0.1_1767818599338_0.3614953813381425","host":"s3://npm-registry-packages-npm-production"}},"2.1.0":{"name":"@carhensi/aws-cdk-cloudfront-key-pair","version":"2.1.0","keywords":["aws","cdk","aws-cdk","awscdk","aws-cdk-construct","cloudfront","key-pair"],"author":{"name":"Carsten Hensiek","email":"carsten@hensiek.com"},"license":"MIT","_id":"@carhensi/aws-cdk-cloudfront-key-pair@2.1.0","maintainers":[{"name":"carhensi","email":"carsten@hensiek.com"}],"homepage":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair","bugs":{"url":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair/issues"},"dist":{"shasum":"f168d378043216c79514e53077e9b9d81920120e","tarball":"https://registry.npmjs.org/@carhensi/aws-cdk-cloudfront-key-pair/-/aws-cdk-cloudfront-key-pair-2.1.0.tgz","fileCount":42,"integrity":"sha512-3idf82U++7h1tmoEH9GrrFWOZF129LAbpE0KO7rSk/VGVm4YDZeE5wDVSERipl3o/caGCXz8knMMd8tYGpSWog==","signatures":[{"sig":"MEQCICKdBreS2a5zdefT/13ozLJ8lqDjoaPo4BKqYv/LUR8OAiAlWbrG5q6WS0hJfu0x04yydTGAHxxugq27OWnrLAwCbA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@carhensi%2faws-cdk-cloudfront-key-pair@2.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1408795},"jsii":{"outdir":"dist"},"main":"lib/index.js","types":"lib/index.d.ts","gitHead":"664c3b9aa667bf7591f491d5b0b79e5a142b857e","scripts":{"lint":"eslint lib src test --ext .ts","test":"jest","build":"jsii","format":"prettier --write \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","package":"jsii-pacmak","prepare":"husky","lint:fix":"eslint lib src test --ext .ts --fix","test:all":"npm test && npm run test:lambda","test:lambda":"npm run test --prefix src/create-key-pair","format:check":"prettier --check \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","semantic-release":"semantic-release"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:09849e5e-413d-4d3e-81a9-d2f7e12d18cf"}},"repository":{"url":"git+https://github.com/carhensi/aws-cdk-cloudfront-key-pair.git","type":"git"},"_npmVersion":"11.7.0","description":"AWS CDK L3 construct for managing CloudFront trusted key group key pairs","directories":{},"lint-staged":{"*.ts":["eslint --fix","prettier --write"]},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^30.2.0","jsii":"^5.9.22","husky":"^9.1.7","eslint":"^9.39.2","ts-jest":"^29.2.0","prettier":"^3.7.4","constructs":"^10.0.0","typescript":"~5.9.3","@types/jest":"^30.0.0","@types/node":"^25.0.3","aws-cdk-lib":"^2.233.0","jsii-pacmak":"^1.125.0","lint-staged":"^16.2.7","semantic-release":"^25.0.2","typescript-eslint":"^8.52.0","@typescript-eslint/parser":"^8.52.0","@typescript-eslint/eslint-plugin":"^8.52.0"},"peerDependencies":{"constructs":"^10.0.0","aws-cdk-lib":"^2.233.0"},"_npmOperationalInternal":{"tmp":"tmp/aws-cdk-cloudfront-key-pair_2.1.0_1767881489683_0.3044037038192282","host":"s3://npm-registry-packages-npm-production"}},"2.2.0":{"name":"@carhensi/aws-cdk-cloudfront-key-pair","description":"AWS CDK L3 construct for managing CloudFront trusted key group key pairs","version":"2.2.0","publishConfig":{"access":"public"},"author":{"name":"Carsten Hensiek","email":"carsten@hensiek.com"},"homepage":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair","repository":{"type":"git","url":"git+https://github.com/carhensi/aws-cdk-cloudfront-key-pair.git"},"license":"MIT","keywords":["aws","cdk","aws-cdk","awscdk","aws-cdk-construct","cloudfront","key-pair","trusted-key-group","signed-urls","content-delivery","security"],"main":"lib/index.js","types":"lib/index.d.ts","scripts":{"build":"jsii","package":"jsii-pacmak","test":"jest","test:lambda":"npm run test --prefix src/create-key-pair","test:all":"npm test && npm run test:lambda","lint":"eslint lib src test --ext .ts","lint:fix":"eslint lib src test --ext .ts --fix","format":"prettier --write \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","format:check":"prettier --check \"lib/**/*.ts\" \"src/**/*.ts\" \"test/**/*.ts\"","prepare":"husky","semantic-release":"semantic-release"},"lint-staged":{"*.ts":["eslint --fix","prettier --write"]},"devDependencies":{"@types/jest":"^30.0.0","@types/node":"^25.0.3","@typescript-eslint/eslint-plugin":"^8.52.0","@typescript-eslint/parser":"^8.52.0","aws-cdk-lib":"^2.233.0","constructs":"^10.0.0","eslint":"^9.39.2","husky":"^9.1.7","jest":"^30.2.0","jsii":"^5.9.22","jsii-pacmak":"^1.125.0","lint-staged":"^16.2.7","prettier":"^3.7.4","semantic-release":"^25.0.2","ts-jest":"^29.2.0","typescript":"~5.9.3","typescript-eslint":"^8.52.0"},"peerDependencies":{"aws-cdk-lib":"^2.233.0","constructs":"^10.0.0"},"jsii":{"outdir":"dist"},"gitHead":"135ecfb61bd24a2c37af599ad100c66d8d55e750","_id":"@carhensi/aws-cdk-cloudfront-key-pair@2.2.0","bugs":{"url":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair/issues"},"_nodeVersion":"24.12.0","_npmVersion":"11.7.0","dist":{"integrity":"sha512-bmpG2C1A1vbOnN8Hcsu/h9YolOG5HrkQzydWuYgxPwL8Om+sNHxOvpb+3/lVbWVIzBo9WkDHPEQTXKarX0bWWg==","shasum":"63e4ec289ea2b5b6230d95f77c87c7ac9030d6b1","tarball":"https://registry.npmjs.org/@carhensi/aws-cdk-cloudfront-key-pair/-/aws-cdk-cloudfront-key-pair-2.2.0.tgz","fileCount":41,"unpackedSize":643413,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@carhensi%2faws-cdk-cloudfront-key-pair@2.2.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIGKWXhA7TBqfs17EdaND31JVM3TzNl6uMkNXN1549lKAAiEAudaQ46vq92et8x8oyswDWUAsgB65FIsQjNNeHjE11tY="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:09849e5e-413d-4d3e-81a9-d2f7e12d18cf"}},"directories":{},"maintainers":[{"name":"carhensi","email":"carsten@hensiek.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/aws-cdk-cloudfront-key-pair_2.2.0_1767883336292_0.45643988408662217"},"_hasShrinkwrap":false}},"time":{"created":"2026-01-07T10:28:53.830Z","modified":"2026-01-08T14:42:17.150Z","1.1.1":"2026-01-07T10:28:54.094Z","1.1.2":"2026-01-07T10:30:27.880Z","1.0.0":"2026-01-07T11:05:40.064Z","1.0.1":"2026-01-07T11:15:49.158Z","1.0.2":"2026-01-07T20:28:26.696Z","1.0.3":"2026-01-07T20:29:22.791Z","2.0.1":"2026-01-07T20:43:19.471Z","2.1.0":"2026-01-08T14:11:29.854Z","2.2.0":"2026-01-08T14:42:16.494Z"},"bugs":{"url":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair/issues"},"author":{"name":"Carsten Hensiek","email":"carsten@hensiek.com"},"license":"MIT","homepage":"https://github.com/carhensi/aws-cdk-cloudfront-key-pair","keywords":["aws","cdk","aws-cdk","awscdk","aws-cdk-construct","cloudfront","key-pair","trusted-key-group","signed-urls","content-delivery","security"],"repository":{"type":"git","url":"git+https://github.com/carhensi/aws-cdk-cloudfront-key-pair.git"},"description":"AWS CDK L3 construct for managing CloudFront trusted key group key pairs","maintainers":[{"name":"carhensi","email":"carsten@hensiek.com"}],"readme":"# @carhensi/aws-cdk-cloudfront-key-pair\n\n[![npm version](https://badge.fury.io/js/@carhensi%2Faws-cdk-cloudfront-key-pair.svg)](https://badge.fury.io/js/@carhensi%2Faws-cdk-cloudfront-key-pair)\n[![Build Status](https://github.com/carhensi/aws-cdk-cloudfront-key-pair/workflows/build/badge.svg)](https://github.com/carhensi/aws-cdk-cloudfront-key-pair/actions)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Security](https://snyk.io/test/github/carhensi/aws-cdk-cloudfront-key-pair/badge.svg)](https://snyk.io/test/github/carhensi/aws-cdk-cloudfront-key-pair)\n\nAWS CDK L3 construct for managing [CloudFront](https://aws.amazon.com/cloudfront) trusted key\ngroup [key pairs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html).\n\n## Features\n\n- 🔐 **Secure Key Generation**: Generates 2048-bit RSA key pairs using Node.js 24\n- 🏗️ **ARM64 Optimized**: Lambda functions run on ARM64 architecture for better performance\n- 🔒 **AWS Secrets Manager**: Stores keys securely with cross-region replication support\n- 🚀 **Modern Stack**: Built with TypeScript 5.7, CDK 2.233+, and comprehensive Jest testing\n- 📦 **Easy Integration**: Simple CDK construct interface\n\nThis construct library extends CloudFormation capabilities by enabling you to easily provision and manage CloudFront\ntrusted group key pairs for restricting access to your CloudFront distribution's origins using signed URLs.\n\n## Installation\n\nTo install and use this package, install the following packages using your package manager (e.g. npm):\n\n- @carhensi/aws-cdk-cloudfront-key-pair\n- aws-cdk-lib (^2.233.0)\n- constructs (^10.0.0)\n\n```sh\nnpm install @carhensi/aws-cdk-cloudfront-key-pair --save\n```\n\n## Usage\n\n### Basic Example\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as cloudfront from 'aws-cdk-lib/aws-cloudfront';\nimport * as origins from 'aws-cdk-lib/aws-cloudfront-origins';\nimport { CloudFrontKeyPair } from '@carhensi/aws-cdk-cloudfront-key-pair';\n\nexport class MyStack extends cdk.Stack {\n  constructor(scope: Construct, id: string, props?: cdk.StackProps) {\n    super(scope, id, props);\n\n    // 1. Create the key pair\n    const keyPair = new CloudFrontKeyPair(this, 'CloudFrontKeyPair', {\n      keyPairName: 'my-app-keypair',\n      keyPairDescription: 'Key pair for signed URLs',\n      // Optional: replicate secrets to other regions\n      secretRegions: ['us-west-2', 'eu-west-1'],\n    });\n\n    // 2. Create a key group with the public key\n    const keyGroup = new cloudfront.KeyGroup(this, 'KeyGroup', {\n      items: [keyPair.publicKey],\n      comment: 'Key group for private content',\n    });\n\n    // 3. Create CloudFront distribution with signed URLs\n    const distribution = new cloudfront.Distribution(this, 'Distribution', {\n      defaultBehavior: {\n        origin: new origins.S3Origin(myBucket),\n        trustedKeyGroups: [keyGroup],\n        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,\n      },\n    });\n  }\n}\n```\n\n### Configuration Options\n\n```ts\nnew CloudFrontKeyPair(this, 'KeyPair', {\n  keyPairName: 'my-keypair',                 // Required: Name prefix for secrets\n  keyPairDescription: 'My key pair',         // Required: Description\n  keyType: 'RSA_2048',                       // Optional: 'RSA_2048' (default) or 'ECDSA_256'\n  secretRegions: ['us-west-2'],              // Optional: Cross-region replication\n  architecture: lambda.Architecture.ARM_64,  // Optional: Lambda architecture (default: ARM64)\n});\n```\n\n| Key Type | Use Case |\n|----------|----------|\n| `RSA_2048` | Default, broader library compatibility |\n| `ECDSA_256` | Smaller signatures, faster signing, modern crypto |\n\n### Accessing Keys for Signing URLs\n\nThe keys are automatically stored in AWS Secrets Manager:\n\n| Key Type | Secret Name Pattern        | Example                    |\n| -------- | -------------------------- | -------------------------- |\n| Public   | `{keyPairName}/public`     | `my-keypair/public`        |\n| Private  | `{keyPairName}/private`    | `my-keypair/private`       |\n\n#### Using AWS CLI\n```sh\n# Get private key for signing\naws secretsmanager get-secret-value \\\n  --secret-id my-keypair/private \\\n  --query SecretString \\\n  --output text\n```\n\n#### Using AWS SDK (Node.js)\n```ts\nimport { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';\n\nconst client = new SecretsManagerClient({ region: 'us-east-1' });\nconst command = new GetSecretValueCommand({ SecretId: 'my-keypair/private' });\nconst response = await client.send(command);\nconst privateKey = response.SecretString;\n\n// Use with CloudFront URL signing libraries\n```\n\n### Granting Access (L3 Pattern)\n\n```ts\n// Grant a Lambda function access to sign URLs\nkeyPair.grantReadPrivateKey(mySigningFunction);\n\n// Grant access to read the public key\nkeyPair.grantReadPublicKey(myVerificationFunction);\n```\n\n### Best Practices\n\n- **Cross-Region Replication**: Use `secretRegions` for multi-region applications\n- **IAM Permissions**: Grant minimal permissions to access only required secrets\n- **Key Rotation**: Consider implementing key rotation for long-lived applications\n- **Monitoring**: Set up CloudWatch alarms for secret access patterns\n\n### Common Use Cases\n\n1. **Private Content Delivery**: Restrict access to premium content\n2. **Time-Limited Access**: Generate expiring URLs for temporary access\n3. **User-Specific Content**: Create personalized signed URLs\n4. **API Protection**: Secure API endpoints behind CloudFront\n\n## Acknowledgments\n\nThis project is based on the original work by [balzanelli](https://github.com/balzanelli/aws-cdk-cloudfront-key-pair) and [Enrico Bertolotti](https://github.com/enricobertolotti). Thanks for the solid foundation! 🙏\n\n## License\n\nMIT License - see [LICENSE](LICENSE) file for details.\n","readmeFilename":"README.md"}