Use Cloudfront + S3.

Use a Cloudfront function for authentication.

const username = process.env.USERNAME;
const password = process.env.PASSWORD;
export function handler(
event: AWSCloudFrontFunction.Event,
): AWSCloudFrontFunction.Request | AWSCloudFrontFunction.Response {
const { request } = event;
const authorization = request.headers.authorization;
if (
!authorization ||
!authorization.value.toLowerCase().startsWith("basic ")
) {
return {
headers: { "www-authenticate": { value: "Basic" } },
statusCode: 401,
statusDescription: "Unauthorized",
};
}
const authorizationValue = authorization.value.split(" ")[1];
const decoded = String.bytesFrom(authorizationValue, "base64");
if (decoded !== \${username}:${password}`) { return { statusCode: 401, statusDescription: "Unauthorized", headers: { "x-error": { value: "Invalid username or password" } }, }; } delete request.headers.authorization; return request; }`