IIRC its essentially the same as the aws style signed urls and header bearer token auth. I _think_ lambda@edge is only relevant if you want to do the initial sig generation in the cdn instead of your api/app endpoint.

Edit: actually GP mentioned Cloudfront already, so yes works as theyre asking for AFAICT