A CloudFront signed URL policy covers the main asset host, but a redirect to the image host drops the signature scope and private media leaks a 403 loop

The control is present, yet the delivery path crosses hostnames that do not share the same authorization contract.