Fedi Instance Admins: S3 buckets and CDNs. Public buckets with a CDN are simple enough.
Private buckets with signed urls...I understand how they work. Call the S3 API to grab a signed URL for a specific private asset, the URL lives short term. Anyone with that signed url can access it (?).
But doesn't it negate the function of a CDN? Seems like using signed URLs would be much more costly since you can't cache them for very long.