There are a number of methods to deliver signed content on AWS. The standard method is to use Signed URLs or Signed Cookies. If you want to control individual files use Signed URLs. This link will help you understand both:
Choosing Between Signed URLs and Signed Cookies
For a good overview of how to serve private content through CloudFront:
Serving Private Content through CloudFront
To create Signed URLs you will need to write code that runs on your server. There are lots of examples on the Internet in many languages. Amazon provides a number of examples also:
Sample Code and Third-Party Tools
Once you create the Signed URL include the URL as a link in the web content that you send to your customer. The customer clicks the link in their browser or web compatible tool. CloudFront / S3 validate the signature and expiration date and then deliver the file contents.