Can you used presigned urls + AWS Media Services?

You can use signed URLs with CloudFront, regardless of the type of origin*.

One thing to be aware is that the media content generated by AWS media services (and other applications) reference other content (e.g.HLS M3U8 references other M3U8s and media fragments, etc). These URLs won't be signed, so you either need to update these (perhaps by using Lambda@Edge) or use CloudFront signed cookies instead.

(* as long as the origin isn't expecting query-string entries with exactly the same names as those for CloudFront signed URLs)