https://cloudgags.in/posts/aws-cloudfront-how-to-secure-your-s3-alb-and-ec2-origins/