Best and performant way of restricting user access to S3?

We are currently signing the url's for Cloudfront, but are experiencing some noticeable performance concerns when it comes to signing the url's - taking 40ms or so per image with Python using the private key.

We want to minimize writes to the database, hence we have come up with caching the 14 day access URL for 7 days with Redis, if any performance gains are retrievable from this.

• But we are really curious if there exists any better way of doing this, or if we have made the correct design for retrieving the images?
• The images use user_UUID/image_UUID as their url by default within S3, perhaps the obfuscation + throttling is enough for some use cases?