I do not really understand the security behind AWS Cloudfront's OAI. The only thing it does is switch the bucket's domain.
Instead of accessing the bucket with
https://s3.amazonaws.com/[Bucket]/* it just switches it with your domain.
But again anyone can browse that bucket/folder knowing the CF domain.
Am I missing something? I know you can add a lambda function at the viewer request side to limit access from a certain app. But how can I prevent users from just trying random URLs. And I don't think its good practice to do authentication and to check if that user should have access to the resource on each request.
So what are good practices to restrict my users to only access the resources that they are allowed to view?