title: Amazon CloudFront vs. S3 --> restrict access by domain?
body: <p>On Amazon S3, you can restrict access to buckets by domain.</p>
  
  <p>But as far as I understand from a helpful StackOverflow user, you cannot do this on CloudFront. But why? If I am correct, CloudFront only allows time-based restrictions or IP restrictions (--> so I need to know the IP's of random visitors..?) Or am I missing something?</p>
  
  <p>Here is a quote from S3 documentation that suggests that per-domain restriction is possible:</p>
  
  <p>---> " To allow read access to these objects from your website, you can add a bucket policy that allows s3:GetObject permission with a condition, using the aws:referer key, that the get request must originate from specific webpages. "</p>
  
  <p>--> Is there a way to make this method work on CloudFront as well? Or why something like this is not available on CloudFront?</p>
  
  <p>--> Is there a similar service where this is possible, easier to setup?</p>