According to your use case, you need a one-time URL using the cloud front, unfortunately using the cloud front, you can create signed URLs, but you can set the expiration time of this URL so that it is not used for one-time use.
URL-, - AWS, IP- URL , WAF.