AWS CloudFront with S3 recommends that you just set your S3 to require a specific 'Referer' header variable and you set CloudFront to send that custom 'Referer' with each origin request.

Seems to work great when you use something like a GUID, and no need for IP whitelisting.