I help run a Roku channel that streams movies 24/7. We use S3 to store the video files, serving a CloudFront distribution, which then sends it to our CDN for distribution to our viewers. Roughly 30,000 actual viewers per week.

BUT, over the last couple of weeks we have been getting a VERY LARGE amount of traffic on the CloudFront distributions from other sources (mostly web browsers according to our logs), bypassing our CDN completely, on the order of 140,000 viewers per week.

How can we stop this "outside" traffic while allowing our CDN traffic to continue? I tried setting up a Web ACL, but since I am a complete novice at it, I can't seem to get it working right.

Please, can someone help me with this? It's costing us $400 this month alone, up from under $100/month.

I can post logs if needed, and more details if you tell me what you need.