You got hired to implement a system for a movie theater company. This system will allow the user to rent movies for a limited period of time. In order to do this, the user will log in to an application and pay to rent the movie. Then a link will be sent to the user through email. The requisite here is only to allow the user to see this file through CloudFront for a limited period of time. What is the easiest way to achieve this?

Answer options:

A.Use AWS Lambda authorizer and CloudFront.
B.Use Lambda, Cognito and CloudFront.
C.Using CloudFront origin access identify (OAI).
D.Using CloudFront with signed URL.

Correct Answer: D
Option A is incorrect because a Lambda authorizer just controls the access to an API. It does not restrict content to CloudFront. More details please check https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html
Option B is incorrect because with this combination of services, you can authenticate users in your application. But none of these services restrict content to users.
Option C is incorrect because CloudFront OAI cannot provide access for a limited period of time.
Option D is CORRECT because with this option, you allow a user to access indivdual files in S3 through CloudFront for a limited period of time. There is an expiration date and time in a signed URL. CloudFront checks the expiration date and time in the URL at the time of the HTTP request. Using this method, you can control the time when the user can see the file.
For more details, please refer to https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html