From Dev.to
Secure File Export for Authenticated Customers — Temporary Links Without Public Objects
Short answer: use a private object and issue a short-lived presigned URL only after your application has authenticated the customer and authorized the export. The link is a delivery credential, not a...