A video platform is migrating MP4 videos to Amazon S3, serving them via CloudFront and EC2. Users hit a frontend that redirects to video URLs containing an authorization token validated by CloudFront. The CloudFront distribution is cached. The team must log authorization token checks to CloudWatch, prevent direct access to video files from CloudFront and S3, and implement token-signature checks provided by the frontend. They also want to perform rolling updates of the token-checking code with minimal operational overhead. Which solution best meets these requirements?

The correct answer is to implement the authorization token check in a CloudFront Function attached to the CloudFront distribution, enable CloudWatch logging for the function, and use CloudFront continuous deployment to roll updates. CloudFront Functions are ideal for lightweight, high-performance edge logic like token validation, executing at CloudFront edge locations with low latency. They support CloudWatch logging for visibility into token checks and CloudFront continuous deployment for rolling updates with minimal operational overhead. This approach also prevents direct access to S3 and CloudFront-cached content by enforcing authorization at the edge. Lambda@Edge is less suitable because it runs in regional AWS data centers, introducing higher latency than CloudFront Functions for simple edge logic. Implementing checks on EC2 instances would bypass CloudFront's caching and security features, allowing direct access to content and increasing origin load. Deploying a second CloudFront distribution for updates is more complex and costly than using CloudFront continuous deployment.