A. Generate pre-signed URLs for each user as they request access to protected S3 content
B. Create an IAM user for each subscribed user and assign the GetObject permission to each IAM user
C. Create an S3 bucket policy that limits access to your private content to only your subscribed users’ credentials
D. Create a CloudFront Origin Identity user for your subscribed users and assign the GetObject permission to this user