Amazon S3 签名 URL 和 Cloudfront - 访问被拒绝

我正在创建一个signed url使用以下内容：

AWS_ACCESS_KEY_ID = my_access_key
    AWS_SECRET_ACCESS_KEY = my_secret_access_key
    KEYPAIR_ID = my_keypair_id
    KEYPAIR_FILE = path_to_keypair_file
    CF_DISTRIBUTION_ID = cf_dist_id
    my_connection = cloudfront.CloudFrontConnection(
        AWS_ACCESS_KEY_ID,
        AWS_SECRET_ACCESS_KEY
    )


    distro_summary = my_connection.get_all_distributions()[0]
    distro_info = my_connection.get_distribution_info(distro_summary.id)
    distro = distro_summary.get_distribution()    

    SECS = 8000
    signed_url = distro.create_signed_url(
                    "https://%s/%s" % (distro_info.domain_name, 'restaurant_1_banner.png'),
                    KEYPAIR_ID,
                    expire_time=time.time() + SECS,
                    valid_after_time=None,
                    ip_address=None,
                    policy_url=None,
                    private_key_file=KEYPAIR_FILE
                    #private_key_string=KEYPAIR_ID
                    )


    return signed_url   

这会返回一个 url，例如：“"

当我点击此链接时，我收到消息：

<Error>
    <Code>AccessDenied</Code>
    <Message>Access denied</Message>
</Error>

这是我的bucket policy for my s3 bucket.

{
"Version": "2008-10-17",
"Id": "PolicyForCloudFrontPrivateContent",
"Statement": [
    {
        "Sid": "1",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3I8A03QRR3ASO"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::menumaster/*"
    }
]
}

如果需要任何其他信息，请告诉我。

这是我的桶政策。

    {
        "Version": "2008-10-17",
        "Id": "PolicyForCloudFrontPrivateContent",
        "Statement": [
            {
                "Sid": "1",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EH238ELEGANOC"
                },
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::onur.deneme/*"
            }
        ]
    }

这是分布： di53i9yykewl5.cloudfront.net

限制存储桶访问：是

原始访问身份：使用现有身份

限制查看者访问（使用签名 URL）：是 可信签名者：自己

不应有其他 ACL 或策略。