What is the simplest way to restrict access to cloudfront distributed files which are stored in S3 to users not authenticated via cognito?
More precisely: I have files stored in S3 the distribution of which I want to accelerate a bit, so I am using a cloudfront distribution. Some of the files should be accessible only to users which are authenticated via cognito.
The web and documentation seems full of remarks on how to access cloudfront on third party servers via signed urls and this sounds very heavy stuff. However, my case is very simple. I want users to authenticate via cognito and then restrict their access to S3-hosted files. So far this seems manageable. However, as soon as cloudfront enters the game things seem to get incredibly difficult. Why?