1. Connect to your CloudFront address
Paste the domain of your CloudFront distribution (no path, no trailing slash). The page will load files through it, not directly from S3. Example: https://d1234abcd.cloudfront.net
2. Images from S3 through CloudFront
Enter the object keys you uploaded to your private bucket (for example images/cat.jpg), one per line. Each one is requested through CloudFront. If a file is missing or blocked, its card shows a message.
3. Video streaming (HLS)
HLS splits a video into small segments listed in a .m3u8 playlist. Enter the key of a playlist you uploaded, for example videos/demo/master.m3u8.
4. What each service does
| Service | What it does | Try this |
|---|---|---|
| S3 | Stores files as objects in buckets. Private by default. | Open the bucket and read Block Public Access. |
| CloudFront | Delivers files from edge locations close to viewers, and caches them. | Open the distribution and read its origin and behaviours. |
| IAM | Controls who and what can do what, using users, groups, roles and policies. | Read the policy attached to your user. |
| Origin access control | Lets CloudFront read a private bucket, and nobody else. | Check the bucket policy that CloudFront added. |
| Signed URLs | Time-limited links that restrict access to a file. | Turn on a restriction on one path and test it. |
| Budgets | Emails you when spending passes a limit. | Create a budget with a small monthly amount. |
5. Practice checklist
- Create a private S3 bucket and upload one image.
- Create a CloudFront distribution with origin access control, and load the image above.
- Open the direct S3 URL and confirm it's denied.
- Create an IAM user limited to this bucket, and read its policy.
- Turn on a budget alert, and check Cost Explorer after a day.
- Delete everything when you finish, to stop charges.