What is the difference between Canned Policy and Custom Policy?

Question

I am looking for an answer at a conceptual level. So please refrain from simply providing a link to Aws documentation as an answer.

It is how a canned policy is generated by boto

@staticmethod
def _canned_policy(resource, expires):
    """
    Creates a canned policy string.
    """
    policy = ('{"Statement":[{"Resource":"%(resource)s",'
              '"Condition":{"DateLessThan":{"AWS:EpochTime":'
              '%(expires)s}}}]}' % locals())
    return policy

And it is how custom policy is generated by the same library

@staticmethod
def _custom_policy(resource, expires=None, valid_after=None, ip_address=None):
    """
    Creates a custom policy string based on the supplied parameters.
    """
    condition = {}
    # SEE: http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/RestrictingAccessPrivateContent.html#CustomPolicy
    # The 'DateLessThan' property is required.
    if not expires:
        # Defaults to ONE day
        expires = int(time.time()) + 86400
    condition["DateLessThan"] = {"AWS:EpochTime": expires}
    if valid_after:
        condition["DateGreaterThan"] = {"AWS:EpochTime": valid_after}
    if ip_address:
        if '/' not in ip_address:
            ip_address += "/32"
        condition["IpAddress"] = {"AWS:SourceIp": ip_address}
    policy = {"Statement": [{
                 "Resource": resource,
                 "Condition": condition}]}
    return json.dumps(policy, separators=(",", ":"))

To my mind, a canned policy is essentially a custom policy but with fewer attributes.

If it is a correct observation, then why the need for two different policies?

Answer 1

Yes, a canned policy can convey only a specific subset of the attributes of a custom policy, but the distinction between the two is more significant.

When you use a canned (pre-defined) policy, the contents of the resulting canned policy document are so deterministic and predictable -- from the elements of the request, itself -- that the policy document doesn't even need to be sent to CloudFront along with the request.

Instead, it's generated locally so that you can sign it, but then it's discarded. The server generates the identical document based on the request parameters, and validates the signature.

By contrast, with a custom policy, the policy document itself is sent with the request, base-64 encoded, in &Policy= in the URL. This makes the URL longer, since the policy document has to be sent along, but the policy document itself is now allowed to contain elements that can't be simply extrapolated from the request by simple examination.

Canned policies, then, are (at least to some extent) more "lightweight" -- shorter URLs mean fewer bytes included in the request, and somewhat less processing needed to use them, but they have less flexibility than custom policies.

Comparison matrix: Using signed URLs @ docs.aws.amazon.com