Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 189 discussion

Since HLS (HTTP Live Streaming) breaks the video into many small chunks (thousands per stream), using signed URLs for every chunk (Option A) would be inefficient and hard to manage. Instead, the simplest and most effective solution is to use CloudFront signed cookies (Option B).

B. Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content. ✅ Why? HLS uses thousands of chunks per video stream. If you use signed URLs (Option A), the application would need to generate a signed URL for each chunk, creating unnecessary overhead. Signed cookies allow multiple requests to be authenticated with a single authentication step. This is more efficient for streaming, as the client can request all chunks without needing new signed URLs each time. The origin URL is hidden behind CloudFront, ensuring users can only access content through the authorized method.

Signed URLs are effective but less efficient than signed cookies for HLS or other scenarios involving many pieces of content. For HLS, where multiple chunks are requested over time, generating signed URLs for each request could become cumbersome and inefficient. Signed cookies are a more scalable solution in such cases. Signed cookies allow the application to grant access to multiple pieces of content (like thousands of video chunks in the case of HLS) without needing to generate signed URLs for each request. This is especially useful for cases where there are many content requests, such as when streaming video or serving large amounts of data that would involve many individual URLs (as in HLS).

is is MOST efficient A using Signed URLs work well for single object access but are inefficient for HLS, which involves thousands of chunk requests. Generating a unique signed URL for each chunk is operationally complex and may degrade performance.

For HLS content, use signed cookies https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-choosing-signed-urls-cookies.html

The simplest and most effective way to protect the content is: A. Develop the application to use the CloudFront key pair to create signed URLs that users will use to access the content. Using signed URLs ensures that only authenticated users can access the content by including additional information such as an expiration date and time in the URL. This method is straightforward to implement and provides robust security for your streaming content.

The answer is B. "signed cookies"