A company streams live video using HTTP Live Streaming (HLS) through Amazon CloudFront. HLS segments videos into thousands of small files. The origin is hidden so all users must access the CloudFront URL. The web app authenticates subscribers against an internal repository, and a CloudFront key pair has been issued. What is the simplest and most effective way to protect the content?

CloudFront signed cookies are the simplest and most effective solution because HLS streams consist of many small files (video segments, manifest files). Signed cookies allow a user to access multiple restricted files for a set duration after a single authentication, without needing to sign each individual file URL. This is ideal for HLS, where a single video playback involves numerous requests. Signed URLs would require the application to generate a unique signed URL for every single segment, which is inefficient and complex for HLS. Using Lambda@Edge for token validation adds complexity and latency compared to native CloudFront signing. Encrypting the CloudFront URL with KMS doesn't provide access control; it only protects the URL itself, not the content delivered through it.