title: S3-backed CloudFront and signed URLs
body: <p>Originally I set up an S3 bucket "bucket.mydomain.com" and used a CNAME in my DNS so I could pull files from there as if it was a subdomain. This worked for http with:</p>
  
  <pre><code>bucket.mydomain.com/image.jpg
  </code></pre>
  
  <p>or with https like:</p>
  
  <pre><code>s3.amazonaws.com/bucket.mydomain.com/image.jpg
  </code></pre>
  
  <p>Some files in this bucket were public access but some were "authenticated read" so that I would have to generate a signed URL with expiration in order for them to be read/downloaded.</p>
  
  <p>I wanted to be able to use https without the amazon name in the URL, so I setup a CloudFront distribution with the S3 bucket as the origin. Now I can use https like:</p>
  
  <pre><code>bucket.mydomain.com/image.jpg
  </code></pre>
  
  <p>The problem I have now is that it seems either all my files in the bucket have to be public read, or they all have to be authenticated read.</p>
  
  <p>How can I force signed URLs to be used for some files, but have other files be public read?</p>