Set Cloudfront signed cookie depending on the source IP adress

Hi,

What's wrong if you just have both, signed cookie check (inbuilt) and your implementation of IP address whitelists with CloudFront Functions? If any of the above failed - you do not provide access.

You can secure access to your S3 content using signed cookies and Lambda@Edge:

1. Write a Lambda function to check the requester's IP against an allow-list.

2. Configure CloudFront to use signed cookies for authentication.

3. Associate the Lambda function with CloudFront to trigger during viewer requests.

4. In the Lambda function, verify the requester's IP against the allow-list.

5. If authorized, generate a signed cookie granting access to the S3 content.

6. Set the signed cookie in the response headers.

7. Test and deploy the setup to restrict access based on IP allow-list.

Perhaps use WAF IP whitelist attached to your cloudfront. Block any IP not in the white list?