Question

A media company stores premium video files in an S3 bucket and serves them to paying subscribers through a CloudFront distribution. The security team requires that each video link works only for a specific authenticated subscriber and automatically stops working after 6 hours. Direct S3 access must remain blocked, and links must not be shareable in a way that grants indefinite access. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable CloudFront signed URLs with a time-limited expiration policy, and use Origin Access Control (OAC) so the S3 bucket only accepts requests from the distribution.

Answer

Attach an AWS WAF web ACL to the distribution with a rate-based rule that limits each subscriber to a fixed number of requests per 6 hours.

Answer

Enable S3 presigned URLs generated by the application and point subscribers directly to the S3 object URLs instead of using CloudFront.

Answer

Configure a CloudFront geo-restriction allow list and require subscribers to log in through Cognito before each playback session.