CreateKeyGroup - Amazon CloudFront
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Creates a key group that you can use with CloudFront signed URLs and signed cookies.

To create a key group, you must specify at least one public key for the key group. After you create a key group, you can reference it from one or more cache behaviors. When you reference a key group in a cache behavior, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see Serving private content in the Amazon CloudFront Developer Guide.

Request Syntax

POST /2020-05-31/key-group HTTP/1.1 <?xml version="1.0" encoding="UTF-8"?> <KeyGroupConfig xmlns=""> <Comment>string</Comment> <Items> <PublicKey>string</PublicKey> </Items> <Name>string</Name> </KeyGroupConfig>

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in XML format.


Root level tag for the KeyGroupConfig parameters.

Required: Yes


A comment to describe the key group. The comment cannot be longer than 128 characters.

Type: String

Required: No


A list of the identifiers of the public keys in the key group.

Type: Array of strings

Required: Yes


A name to identify the key group.

Type: String

Required: Yes

Response Syntax

HTTP/1.1 201 <?xml version="1.0" encoding="UTF-8"?> <KeyGroup> <Id>string</Id> <KeyGroupConfig> <Comment>string</Comment> <Items> <PublicKey>string</PublicKey> </Items> <Name>string</Name> </KeyGroupConfig> <LastModifiedTime>timestamp</LastModifiedTime> </KeyGroup>

Response Elements

If the action is successful, the service sends back an HTTP 201 response.

The following data is returned in XML format by the service.


Root level tag for the KeyGroup parameters.

Required: Yes


The identifier for the key group.

Type: String


The key group configuration.

Type: KeyGroupConfig object


The date and time when the key group was last modified.

Type: Timestamp


For information about the errors that are common to all actions, see Common Errors.


An argument is invalid.

HTTP Status Code: 400


A key group with this name already exists. You must provide a unique name. To modify an existing key group, use UpdateKeyGroup.

HTTP Status Code: 409


You have reached the maximum number of key groups for this Amazon Web Services account. For more information, see Quotas (formerly known as limits) in the Amazon CloudFront Developer Guide.

HTTP Status Code: 400


The number of public keys in this key group is more than the maximum allowed. For more information, see Quotas (formerly known as limits) in the Amazon CloudFront Developer Guide.

HTTP Status Code: 400

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: