I encountered a really strange issue lately when using Amazon CloudFront, and I couldn't figure out why. Here is my setup:

• S3 bucket (A) with OAI s3:GetObject configured in the bucket policy
• CloudFront with S3 origin (A) and trusted signer configured to restrict viewer access

So far so good. It's a pretty simple and straightforward setup. Now here comes the weird part.

If I forward Host header to the origin (in this case bucket A), then the CloudFront signed URL would return SignatureDoesNotMatch error.

Does anyone know why this would happen? Thanks in advance.