How to restrict user to directly access static files hosted on Cloudfront

Question

I am hosting micro-frontends on S3 behind Cloudfront. I do not want people to access static files through direct URL. I was looking for solution and found we can protect through access token which can be validated by Lambda@Edge. I don't want Lambda@Edge to check if user is authenticated for each file as there will be multiple static files used by actual website and for each file if Lambda validates the token, it will become slow.

Answer 1

You can use signed cookies approach to protect all restricted content on your CloudFront distribution. Your application will need to set the cookie once and then pass it as headers to all requests to CloudFront. See official docs for details.

Lambda@Edge approach can also work in your case as it does not need to be slow. If you have multiple resources, they can be retrieved in parallel, so latencies should not compound.