How to secure a bucket without Access Keys

Hi,

Im holding a bucket with thousands of of small files (3dTiles for map streaming viewer).

I want to keep my raw data secure so that its accesible only through my app.

I dont want to proxy the files through my own software or implement a temporary signed url for each individual file. That creates a wastfull overhead and looses the whole benefit of CDN , cache, loadbalancing etc.

Right now I’ve set a CDN with CloudFlare and applied a firewall over there so that only my app can access the cdn url.

But if somehow the url from digitalocean leaks all my files are readble.

Is there a way to set up a kind of firewall to allow only calls from the subdomain set by the cdn?

That way I can leverage the firewall in the subdomain