Media access restricted to certain FQDN.

is there any way that media (served from cloudfront using signed URL) can be limited to be accessed by certain FQDN?
Solution using API G/W or WAF preferred.