Custom policy malformed when using Cloudfront Signer

[Poolshark]

I'm currently trying to set up a Lambda which returns signed cookies for Cloudfront to access files on my S3. This works if I make requests to a single file but since I'm planning to use this for video streams, I need permission to an entire folder on my S3. The official Docs say that wildcards can only be used when signing cookies via Custom Policy.

Im currently using @aws-sdk/cloudfront-signer in version 3.254.0. If I use it without the policy property and request a specific file, it works. So if I want to access https://mycloudfront.com/path-to-file/file.m3u8 and use

const getExpTime = new Date(Date.now() + 5 * (60 * 60 * 1000));

const signedCookie = getSignedCookies({
  keyPairId: 'MY-KEYPAIR-ID',
  privateKey: 'PRIVATE KEY',
  url: 'https://mycloudfront.com/path-to-my-file/file.m3u8',
  dateLessThan: getExpTime.toISOString(),
});

it works. However, when trying to set up a custom policy with

const policyString = JSON.stringify({
  Statement: [
    {
      Resource: 'https://mycloudfront.com/path-to-my-file/file.m3u8',
      Condition: {
        DateLessThan: { "AWS:EpochTime": getExpTime.getTime() },
      },
    },
  ],
});

const signedCookie = getSignedCookies({
  keyPairId: 'MY-KEYPAIR-ID',
  privateKey: 'PRIVATE KEY',
  policy: policyString,
  url: 'https://mycloudfront.com/path-to-my-file/file.m3u8',
});

it fails with the

Malformed Policy error

I've also tried to remove the Resource from the policy string but no luck. How am I supposed to use the Cookie Signer with a custom policy? unfortunately I could not find any documentation for v3.

Cheers, any help appreciated! 🙌

[idwalkill]

I've managed to get wildcard functionality working in v2 but no luck in v3 yet.

#4507

Hopefully someone can provide some migration guidance soon.