Maybe you might have got the below error when you have configured CloudFront distribution like it happened to me.

<Error>
  <Code>SignatureDoesNotMatch</Code>
  <Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
</Error>

If so, maybe like me you might have configured the custom origin request policies and have allowed All viewers headers like the below.

The issue is, if your origin is S3, something between CloudFront and S3 doesn’t expect all the headers which does not compute the signature in the same way, resulting in the above error.

You can resolve by using Managed-CORS-S3Origin as the Origin request policy as part of the Cache key and origin requests.