So i have been following this article:

https://aws.amazon.com/tr/blogs/networking-and-content-delivery/secure-and-cost-effective-video-streaming-using-cloudfront-signed-urls/

I am facing with a strange error at this step:

Since cloud front removes mentioned parameters when its directing request it to my origin, i need to add them on my server as Key-Pair-Id-PREFIX, Policy-PREFIX and Signature-PREFIX

I am adding them as stated in documentation but as soon as i add a query parameter, i suddenly immediately get access denied error from signed url.

If i dont add any query parameters in addition to what is generated i can access the resource.
Access granted:
https://d4btsmypjqzd3.cloudfront.net/streams/oiilo65vhierva0n/rvj7m3ep1bgy76brsvnecbr5k9glvdp1/2024-08-05_22-07-56.562/rvj7m3ep1bgy76brsvnecbr5k9glvdp1-2024-08-05_22-07-56.562.m3u8?Policy=somepolicy&Key-Pair-Id=somekeypairid&Signature=somesignature

Access denied:
https://d4btsmypjqzd3.cloudfront.net/streams/oiilo65vhierva0n/rvj7m3ep1bgy76brsvnecbr5k9glvdp1/2024-08-05_22-07-56.562/rvj7m3ep1bgy76brsvnecbr5k9glvdp1-2024-08-05_22-07-56.562.m3u8?Policy=somepolicy&Key-Pair-Id=somekeypairid&Signature=somesignature&Policy-prefix=somepolicy&Key-Pair-Id-prefix=somekeypairid&Signature-prefix=somesignature

But my origin needs to know about mentioned query params so that i can modify the m3u8 with those.
But i cannot pass them because as soon as i add them to url access denied occurs. very strange

Why??
Behaviour settings: