A company is building a mobile app and expects millions of users. Authorized users must be able to stream the company’s content to their mobile devices. What should a solutions architect recommend?

The correct solution is to use Amazon CloudFront with signed URLs. CloudFront is a global content delivery network (CDN) that caches content closer to users, reducing latency and improving streaming performance for millions of users. Signed URLs provide secure, time-limited access to content, ensuring only authorized users can stream. Publishing content to a public Amazon S3 bucket with AWS KMS keys is insecure for streaming, as KMS keys are for encryption, not access control for public content. Setting up IPsec VPN or AWS Client VPN between mobile apps and the AWS environment is impractical and inefficient for millions of mobile users, as VPNs are typically for secure network-to-network or client-to-network access, not high-volume content delivery.