Question

A media company hosts premium video files in an Amazon S3 bucket served through Amazon CloudFront. The business requires that only authenticated, paying subscribers can access individual video files, and each access link must automatically expire 15 minutes after it is issued. The company wants to enforce this without exposing the S3 bucket publicly. Which approach meets these requirements?

Accepted Answer

Configure CloudFront signed URLs with a short expiration time and use an Origin Access Control (OAC) so the S3 bucket is only accessible via CloudFront.

Answer

Enable AWS WAF on the CloudFront distribution with a rate-based rule that blocks requests after 15 minutes of activity.

Answer

Attach a bucket policy that allows public read access and rely on CloudFront geo-restriction to limit who can view the content.

Answer

Use CloudFront field-level encryption to encrypt the video files and distribute decryption keys to subscribers.