Signed cookies in aws cloudfront without Key Pair (RSA private key)

[fernandezgom]

I am seeing your amazing tool and checking the possibitily of adding as dependency of my project. The thing is: I am deploying my app split in microservices in disposable machines(AWS-ECS) using Docker. I would like not to include any CloudFront Key Pair since these machines can die and storing files (*.pem) inside makes no sense. Is there any way to get signed tokens just granting privileges with IAM policies, e. g, CloudFrontFullAccess? avoiding Key Pair as other AWS services (e.g. from S3 I get signed url's, with proper IAM policy)