You can use signed URLs with CloudFront, regardless of the type of origin*.
One thing to be aware is that the media content generated by AWS media services (and other applications) reference other content (e.g.HLS M3U8 references other M3U8s and media fragments, etc). These URLs won't be signed, so you either need to update these (perhaps by using Lambda@Edge) or use CloudFront signed cookies instead.
(* as long as the origin isn't expecting query-string entries with exactly the same names as those for CloudFront signed URLs)
What's the best practice for sharing videos hosted on Amazon S3 using presigned URLs?Accepted Answerasked 5 years ago
Access S3 object via cloudfront as a specific IAM userAccepted Answerasked a year ago
showing search results with download links with presigned urlsasked 5 months ago
Signing CloudFront URLs with aws:kms encryptionasked 5 years ago
S3 presigned URLs not working with Safari 15/iOS 15Accepted Answerasked 3 months ago
Can I create a child AWS account and prevent the master from accessing it?Accepted Answerasked 4 years ago
Can you used presigned urls + AWS Media Services?Accepted Answerasked 2 years ago
How to restrict download permission for content served from presigned-urlasked 4 months ago
Can you use Media Converted files outside of AWS?asked 2 years ago
How to enable presigned S3 URL for different users?asked 9 months ago