Question

A media company stores premium video files in a private S3 bucket. Subscribers stream this content globally through a CloudFront distribution. The company needs to ensure that only authenticated, paying subscribers can access the videos, that access expires after a set time, and that content is delivered with low latency worldwide. Users must not be able to bypass CloudFront and reach S3 objects directly. Which approach best meets these requirements?

Accepted Answer

Configure CloudFront signed URLs (or signed cookies) with a time-limited expiry, and restrict the S3 bucket to allow access only from the CloudFront distribution using Origin Access Control (OAC).

Answer

Generate S3 pre-signed URLs from the application backend and distribute them directly to subscribers to download from the bucket.

Answer

Make the S3 bucket public and use a CloudFront geo-restriction to limit which countries can access the content.

Answer

Attach a bucket policy allowing s3:GetObject to all authenticated AWS IAM users and share IAM credentials with subscribers.