Signed cookies beat per-object signed URLs when a player must fetch many media segments under one policy: mint CloudFront-Policy, CloudFront-Signature, and CloudFront-Key-Pair-Id once for a path prefix, set Path and Domain so every segment request carries them, and keep the private behaviour on a trusted key group. Do not fold Cookie into the public cache key for hashed or long-TTL objects; validate the signature at the edge, then serve under the same host-path key anonymous fills would use so cardinality stays flat. Prefer short-lived policies for live or rental windows, and rotate key groups on a schedule rather than only after an incident.

Ops prove-out after enabling the restricted behaviour: request a protected playlist and two segments from a clean client that already holds a valid signed cookie and expect MISS then HIT with a rising Age on the shareable objects; repeat without the cookie and confirm the edge rejects before any origin fill. After rotating a key group, invalidate the private paths that still hold bodies signed under the old key and re-check X-Cache until the prior object is gone — most post-rotation tickets are an un-purged edge object or a second behaviour still forwarding Cookie into the public key, not a broken signer.