"You set the Amazon S3 ACL on your objects so that only you and CloudFront have read permission for the objects. This means that end user access to the objects can only be through CloudFront."
If an authorized end user (meaning they have a valid signed URL) is ripping the content I don't see a way anyone could stop that. If nothing else I could easily just record my screen with a screen capture program. :)
The ACL is for the S3 and not the CloudFront.
Don't take my word for it:
http://developer.amazonwebservices.com/connect/thread.jspa?t...
http://developer.amazonwebservices.com/connect/thread.jspa?t...
http://developer.amazonwebservices.com/connect/thread.jspa?t...
Edit: The signed URL protects the "copy and paste" but not the "easy" ripping.