Question

A media company streams paid video-on-demand content through a CloudFront distribution backed by an S3 origin. Subscribers watch multiple videos per session across many files with a common URL path prefix. The company needs to restrict access so only authenticated, paying subscribers can view the content, without generating a separate URL for every individual file the user requests. Which approach meets these requirements?

Accepted Answer

Use CloudFront signed cookies with a policy that grants access to the content path prefix, and set the cookies after the user authenticates.

Answer

Generate a CloudFront signed URL for each individual video file and return it to the browser at the start of every playback request.

Answer

Enable Origin Access Control (OAC) on the distribution so only CloudFront can read the S3 objects.

Answer

Apply an S3 bucket policy that restricts GetObject to the IP ranges of authenticated subscribers.