HLS streams from AWS S3 without using CloudFront

Is it possible to serve HLS streams from AWS S3 without using CloudFront?

I know it’s not as efficient. (And the tutorial doesn’t cover it.)

But, I tested it on my website, and it seems to work.

Could you confirm that this is not a problem?

The reason I ask is, when serving files from S3, I can protect them
against hotlinking by using a bucket policy like:

“Sid”: “Explicit deny to except from specific referer.”,
“Effect”: “Deny”,
“Principal”: “*”,
“Action”: “s3:*”,
“Resource”: “<my_s3_bucket>/*”,
“Condition”: {
“StringNotLike”: {“aws:Referer”: [“https://<my_domain>/*”%5D}
}

to make sure that any connections originating outside of my domain are
disallowed.

This way, even when some gets access to the url to the m3u8 file (for
instance “Video Download Helper” does), they cannot download it.

With CloudFront it’s possible to download the m3u8 from the url, and
theoretically, the rest of the HSL streams. Yes, I guess it’s encrypted,
but… preventing access to an encrypted file seem like another layer of
security compared to just encrypting the file.

Cheers,

-E

PS – If directly serving from S3 is not a security problem (in the way
the player works), you may want to add it to the HLS setup documentation.