CloudFront + private S3 OK