https://james.cridland.net/blog/2021/how-to-only-allow-cloudfront--and-your-own-development-team--to-see-your-publicly-available-ec2/