Yes, that's what I've been reading + https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html
Setting all of this up with terraform is what I found challenging. In any case I think I figured it all out, so now I guess I should write a blog about it for future me and others 😄