"You set the Amazon S3 ACL on your objects so that only you and CloudFront have read permission for the objects. This means that end user access to the objects can only be through CloudFront."

The ACL is for the S3 and not the CloudFront.

Don't take my word for it:

http://developer.amazonwebservices.com/connect/thread.jspa?t...

http://developer.amazonwebservices.com/connect/thread.jspa?t...

http://developer.amazonwebservices.com/connect/thread.jspa?t...

Edit: The signed URL protects the "copy and paste" but not the "easy" ripping.