AWS › Amazon CloudFront & Content Delivery

How do you secure content delivered through CloudFront so only authorized users can access it?

Intermediate

Answer

CloudFront supports signed URLs and signed cookies that let you generate time limited, cryptographically signed links to private content, as well as Origin Access Control which ensures that an S3 origin can only be accessed through CloudFront and never directly, preventing users from bypassing your distribution entirely.

aws cloudfront sign --url https://example.com/video.mp4 --key-pair-id ABC123 --private-key file://private_key.pem --date-less-than 2026-12-31

Real-world example A video streaming platform generates signed URLs that expire after a few hours for each customer's video, ensuring that a shared link cannot be used indefinitely by unauthorized viewers.

Common follow-ups: What is the difference between signed URLs and signed cookies?;How does Origin Access Control differ from the older Origin Access Identity?

IAM;S3 & Storage