It depends on the data you are storing, using unique UUIDs for something like profile image(avatar?) is good enough, as I commented here the probability of a co

It depends on the data you are storing, using unique UUIDs for something like profile image(avatar?) is good enough, as I commented here the probability of a collision is so low that you can assume them to be not iterable for practical purposes. Just be sure to not enable list APIs for public use in your bucket. The other solutions you have where you authenticate the path as such, which should ideally be used for more sensitive assets: - Proxy asset requests through application server, let it authenticate the user access. You can even generate short lived S3 urls this way, and your objects don't have to be public. - Proxy asset requests through a reverse proxy like Nginx, authenticate there, you have a lot of options here like using something like JWT to authenticate the resource access. - Proxy asset requests through your reverse proxy CDN like Cloudflare, authenticate there, like in case of Cloudflare JWT is supported.