Serve Private Spaces Object to Browser via CDN

Posted April 18, 2020 2.3k views
DigitalOcean Spaces

I am trying to access files uploaded to my Spaces bucket. They are private and associated with my users account. I authenticate on my server and was hoping to redirect to a URL where they can see the file.

I have this working with a pre-signed getObject URL. However, I would really prefer to gain the benefits of serving my files from the CDN. Here is what I am doing successfully now:

  accessKeyId: KEY,                                                    
  secretAccessKey: SECRET,                                             
  region: 'nyc3',                                                      
  signatureVersion: 'v4',                                              

const options = {                                                      
  signatureVersion: 'v4',                                              
  region: 'nyc3',                                                      
  endpoint: new AWS.Endpoint(''),

const client = new AWS.S3(options);                                    

const url = client.getSignedUrl('getObject', {                         
  Bucket: 'myBucket',                                                
  Key: 'theObjectKey',                                                    
  Expires: 5 * 60, // 5 minutes                                        


This provides me with a URL like:

This works well.

Is there any possible way to do this, but using my Spaces CDN? It appears that AWS’ Cloudfront has a completely different lib for signing CF objects (seen here:

Any help is much appreciated. Happy to answer any questions.

  • As of 10-10-2020 this is still an issue and no private objects can be served using a custom domain!

    I’ve opened this on the django-storages repo but hard to tell whether a fix is possible given its really digital ocean specific.

  • I’ve been experiencing the same problem myself. From what I can tell, using the CDN URL does not expire the link properly.

    The more I use Spaces the more I’m getting tired of fighting with it.

    (Still a HUGE security issue where API keys can not be issued to a single Space… cough cough)

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

Assuming that you have already enabled your CDN, have you tried using the same URL that getSignedUrl returns, but with the domain changed to point to the CDN?

E.g., instead of:


You can use a pre-signed URL with the CDN as shown in the following documentation

Please let me know if this helps you out.