Example to generate Signed URLs in CloudFront using Canned Policy.

CloudFront Signed URL Canned Policy.js

const AWS = require('aws-sdk');

// Try to use process.env.PRIVATE_KEY instead of exposing your key
const privateKey = `-----BEGIN RSA PRIVATE KEY-----
  XXXXXXXX
  XXXXXXXX
  XXXXXXXX
  XXXXXXXX
-----END RSA PRIVATE KEY-----`

const cloudFront = new AWS.CloudFront.Signer('PUBLIC_ACCESS_KEY', privateKey);

cloudFront.getSignedUrl({
  url: 'https://abcdefghijklmn.cloudfront.net/test/a.txt',
  expires: Math.floor((new Date()).getTime() / 1000) + (60 * 60 * 1) // Current Time in UTC + time in seconds, (60 * 60 * 1 = 1 hour)
}, (err, url) => {
  if (err) throw err;
  console.log(url);
});