SCORM packages fail to load referenced JS/CSS when using S3 pre-signed URLs (403 on relative assets)

[robursolutions]

Hello,
we are encountering an issue with SCORM packages when ObjectFS is configured with S3 pre-signed URLs.

Description
When a SCORM package is stored on S3 via ObjectFS:
the entry point (index_lms.html) is served using a pre-signed S3 URL
relative assets referenced in the HTML (JS/CSS/images) are then requested by the browser as direct S3 URLs
these asset requests are not signed and therefore return 403 AccessDenied
Once the HTML is loaded directly from S3, asset requests no longer pass through pluginfile.php, so ObjectFS cannot generate pre-signed URLs for them.

Expected behavior
Ideally, the SCORM entry HTML should be served by Moodle, while referenced assets should be redirected to S3 (or CDN) using pre-signed URLs.

CloudFront note
We plan to introduce Amazon CloudFront in front of the S3 bucket and configure ObjectFS to use CloudFront signed URLs.
Before doing so, we would like to understand whether:

this behavior is expected with S3 pre-signed URLs and SCORM,
CloudFront signing is expected to mitigate the issue,
or if a different ObjectFS configuration is recommended.

Thanks for your support.